A Data Security Policy Template for Offshore Staff

Part of our guide: How do you keep data secure with offshore staff?

A one-page security policy, signed before access is granted, prevents most problems with offshore staff. Copy and adapt this template. It's part of our guide to data security with offshore staff. It is not legal advice; have counsel review it for regulated data.

1. Accounts and access

• Every person gets a named account. No shared logins.
• Access is granted at the lowest level needed for the role and reviewed monthly.
• Multi-factor authentication is required on email, accounting, CRM and any system with customer data.

2. Passwords

• All credentials are stored in the company password manager. Never in documents, chat or browser notes.
• Passwords are never shared by email or messaging.

3. Devices and workspace

• Work happens on a device with a supported operating system, automatic updates, disk encryption and screen lock.
• No company data is stored on personal USB drives or personal cloud accounts.
• Calls with confidential content happen in a private space.

4. Data handling

• Download only what the task needs and delete it when done.
• Customer financial data and health data (if any) never leave the approved systems.
• No company data is pasted into public AI tools without written approval.

5. Payments and fraud

• Staff never change vendor bank details without owner verification by phone.
• Urgent payment requests from executives are confirmed on a second channel.

6. Incidents

• Report any suspected phishing, lost device or mistaken disclosure within one hour to [contact].
• Don't try to fix it quietly; fast reporting limits damage.

7. Offboarding

• Access to every system is removed on the last day, using the access register.
• Company data on the device is deleted and confirmed in writing.

Acknowledgment

"I have read and will follow this policy." Name, date, signature.

Related: least-privilege access checklist, password manager setup, secure offboarding.