A Data Protection Policy (or SOP) is a work instruction that sets out responsibilities and processes to ensure compliance with the GDPR in your company. It covers much more than just data security. In my opinion, a Data Protection Policy is the most important and often neglected data protection instrument in medium and large-sized companies.