Role
Data protection officer
What do you not know about your personal data until someone files an erasure request? Usually how many places that data sits in - and that the record of processing activities describes only part of them.
Intro call
Four questions we would start with
What do you not know about where data sits until a request arrives?
If answering "where is this person's data" means phoning round five departments, the statutory deadline is a risk with every request.
How quickly do you find out about a breach?
The regulation gives seventy-two hours from becoming aware. The question is how long passes between the event and becoming aware.
Who notices first that a department has started collecting new data?
If nobody does, the record of processing activities describes last year's state rather than the current one.
What happens when a supplier processes data without a processing agreement?
Whether somebody catches it when the contract is signed, or only at a review.
We take over the records and the deadlines, you keep the judgement and the decisions
Keeping the register, handling requests, watching deadlines and overseeing processors can be taken off the desk. Judging whether a breach occurred and whether to report it stays with the officer.
- The record of processing lives with the processes. - A new process or a new system reports itself as an activity to be described, instead of waiting for the annual review.
- A data subject request has its deadline watched. - From receipt to answer, with a summary of the places this person's data appears in.
- A processing agreement is a condition, not a formality. - A supplier processing data without one is pointed out before the work starts, not after.
Scope
What can be taken off data protection
Twenty-two example tasks. Each one has a human approval point. Below is a selection, and the scope we fit to your processes.
The record of processing
- A register of activities with the purpose, the legal basis and the categories of data
- Linking an activity to systems and departments
- A signal when a new system has no activity assigned
- A review of activities unchanged for a long time
- Pointing out activities with no retention period stated
Legal bases and consents
- A register of legal bases by activity
- A record of consents with the date and the scope
- A signal when a consent is withdrawn and what follows from it
- Pointing out activities based on consent where another basis is possible (assessment: the officer)
Data subject requests
- One route for receiving a request
- A summary of the places a person's data appears in
- Watching the statutory deadline
- A draft answer (approval: the officer)
- A register of requests with the type and how it was resolved
Incidents and breaches
- One route for reporting an incident from any department
- Gathering the facts needed for the assessment
- Counting the deadline from becoming aware of the breach
- An assessment and a recommendation on whether the breach is notifiable (recommendation: the officer, decision: the controller)
Processing agreements
- A register of processors
- A signal when a supplier processes data without an agreement
- A review of the scope of the agreement against the actual processing
- Dates and changes in the processing agreements
A day's work
Today
- You update the record of processing once a year, by asking departments
- You learn about a new system once it is already running
- At a data subject request you phone round departments looking for the data
- You watch the statutory deadline in a calendar
- You hear about an incident from somebody who heard about it
- You establish which suppliers process data at a review
With AI assistance
- A new system or process reports itself as an activity to be described
- The register shows activities with no legal basis or no retention
- At a request you see a summary of the places the data appears in
- The deadline is counted and reminded
- An incident has one reporting route from any department
- A supplier with no processing agreement is pointed out before the start
- A complete register
the register describes the current state, not last year's
new systems and processes report themselves
- Time to handle a request
fewer requests handled at the edge of the deadline
the places the data appears in are summarised
- Detecting breaches
a shorter time between the event and becoming aware
reporting an incident has one route
- Control over processors
fewer suppliers processing data without an agreement
a missing agreement is pointed out before the start
We start with the record of processing, because every other obligation rests on it.
- Step 1
A register linked to systems and departments
Activities, legal bases, retention, systems. Gaps become visible as gaps.
- Step 2
Handling requests with the deadline
One route, a summary of where the data sits, the deadline watched.
- Step 3
Incidents
Reporting from any department, gathering the facts, counting the deadline.
- Step 4
Processors
A register of processors and signals about gaps. Last, because it needs the register from step 1.
Common questions
Questions that come up at the first meeting
Who is accountable for assessing a breach?
Two things are worth separating, because confusing them tends to be picked up at an inspection. A breach is notified by the controller, that is your organisation - just as it is the controller who keeps the record of processing. The officer advises, monitors and prepares the assessment, but does not decide for the controller; assigning that to them would in fact conflict with their role. The system gathers the facts, counts the deadline and reminds - the recommendation belongs to the officer, the decision to the controller.
Does the officer become less needed?
The officer's role is established by regulation and consists of advising and monitoring - that cannot be moved onto a tool and we do not try. We take over keeping the register, watching deadlines and assembling the data for requests. An officer who is not doing that by hand stops being a formal role and starts seeing what actually happens to the data.
Does this fall under the AI Act?
Supporting the officer is not a high-risk use, but the area concerns personal data by its nature, so we run the project by the minimisation principle: the tool sees metadata about activities and systems, and access to the personal data itself is limited to what is necessary when handling a particular request.
Still have a question that is not here? Book a call
Next step
How long would it take you today to point to every place holding one person's data?
We will show you what data protection looks like when the register lives with the processes and the deadline on a request is watched.