---
title: "Keep an internal security policy | GDPR | ThriveDesk"
canonical: "https://www.thrivedesk.com/gdpr/checklist/security-policy/"
author: ThriveDesk
description: Our team works to a written security policy and trains on it every quarter.
categories: [legal]
---

Data security

# Keep an internal security policy

Done

Our team works to a written security policy and trains on it every quarter.

-   The policy covers devices, access, passwords and how to handle customer data.
-   The whole team trains on data protection in the last week of every quarter.
-   Staff can only open customer data at their own permission level, and only when a support request or incident needs it.

Questions? Email [help@thrivedesk.com](mailto:help@thrivedesk.com) with "Data protection" in the subject line, or go back to [where we stand on GDPR](https://www.thrivedesk.com/gdpr/).