Your responsibility /Finance and contracts
The contracts pass through you, and so does the question of which version applies.
The data processing agreement with the system supplier, the annex a tender wants by Friday.
For the finance director, the controller and purchasing. Included at every level, from the smallest upwards.
Some of the areas that usually sit with you
- GDPR and personal data 4 documents
- Information security 4 documents
- HR and employment law 3 documents
11 documents written for your company, each with its statute on it.
You are the last check before anything leaves the company. Which means the mistake becomes yours, even when the document was written by somebody else two years ago.
Versions are where it breaks. Two near-identical files sit in different folders, and the one that gets sent is the one that could be found.
What you need is a single place where only one version is in force, with a date and a signature on it.
Four situations you meet
- A tender asks for annexes at short notice
- Policies in the version in force, often a code of conduct
- A new system supplier needs a contract
- Data processing agreement, updated record of processing
- A customer imposes requirements you must pass on
- Supplier requirements in writing
- The auditor asks about routines
- Documented routines with approval dates
Examples of the documents you get
| GDPR AND PERSONAL DATA | STATUTE |
|---|---|
| Record of processing activities | GDPR Article 30 |
| Data processing agreement | GDPR Article 28(3) |
| Routine for a personal data breach | GDPR Articles 33 and 34 |
| Routine for retention and access | GDPR Article 32 |
| INFORMATION SECURITY | STATUTE |
|---|---|
| Information security policy | GDPR Article 32 |
| Routine for access and permissions | GDPR Article 32 |
| Supplier requirements | Customer requirements and GDPR Article 28(3) |
| Material for security questionnaires | Customer requirements |
| HR AND EMPLOYMENT LAW | STATUTE |
|---|---|
| Written information on employment terms | Employment Protection Act (1982:80) section 6 c |
| Employee Handbook | Not required by law. The document people actually read |
| Policies every employee is covered by | Follows from each area |
Version history and the approval trail start at Kontroll. On Ordning the document carries its version, but not the trail between versions.
Checked against GDPR Articles 28 and 32, and the Employment Protection Act section 6 c · Updated 10 October 2026
How it starts
The Health Check gives you a list of gaps for finance and contracts, area by area. You do not have to hand over any personal data to see it.
How it continues
The documents are written for your company and hold together with one another. Change one and you see what it means for the others.