GV002Declared perimeter

The single account of what the program does, what it does not do, and on what authority, written to be shown outside it.

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
GV002/GBMandatory	United Kingdom	Data Protection Act 2018, section 10 and Schedule 1Parliament of the United Kingdom · read 30 Aug 2026	The condition on which an employer may process a closed category at all, and the document that condition requires to exist before the processing starts.	Where an employer processes a closed category under the employment condition, an appropriate policy document has to be in place when the processing is carried out, and it has to have been produced: a document explaining the procedures for securing compliance with the principles for that processing, and the policies on retention and erasure with an indication of how long the data are likely to be kept. It is a condition of the processing being lawful and not a record made afterwards.