Mandatory under UK GDPR. Must cover: identity and contact details of the controller, the data protection officer if appointed, categories of personal data collected, lawful basis for each purpose, recipients, retention periods, international transfers, data subject rights, right to complain to the ICO, and the specific processing involved in the document vault. Draft by the firm; do not publish a template.