What it asks for. Agreements reflecting the organisation's need to protect information should be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties.
In practice. Legal maintains standard agreements for employees, contractors, suppliers and other parties, covering what information is protected, how long obligations last, what happens on breach and how information is returned or destroyed at the end. Agreements are signed before access is given and stored so they can be found. Templates are reviewed periodically and when the organisation's needs or the law change. Evidence includes current templates, signed agreements for sampled people or suppliers and a record of template reviews.
Common gaps. Signed copies are often missing for long standing staff or for contractors engaged through agencies. Templates also go years without review, so they may not reflect current information types or legal requirements.