Introduction & Applicable Laws
The first workshop lays the foundation. The team learns the essential data protection concepts, identifies which laws apply to the organisation, defines the scope of the programme and agrees on the team and schedule for all 13 workshops.
Workshop 1 video
Walkthrough of the workshop and its tasks — coming soon
What ResGuard provides
- Workshop 1 as a ready-made objective: every task with guidance, expected result and due dates in the Objective Manager
- Training slides for the fundamentals session, with the rules of your jurisdiction on every slide
- Template for the data protection scope document: applicable laws, scope and roles
- Data Protection Assessment: a checklist of your jurisdiction's obligations with an automatic action plan and compliance score
Workshop tasks
-
1. Data protection fundamentals
Make sure the team shares the same concepts: personal and sensitive data, processing, controller, processor and data subject, and the core principles such as purpose limitation, proportionality, data quality and security.
Presentation: open the slides for this task -
2. Identify applicable laws
Determine which laws apply based on where the organisation operates, where the people whose data it processes are located, sector rules and contractual commitments to clients. Document them in the data protection scope document, starting from its template in the Policy Framework.
In ResGuard: Policy Framework -
3. Define the programme scope
Define which entities, locations, processes and groups of data subjects (clients, employees, applicants, vendors) the programme covers, and document them, including any exclusions, in the same data protection scope document.
In ResGuard: Policy Framework -
4. Project team & roadmap
Name a management sponsor, a programme lead and contacts in HR, IT, sales and marketing. Plan dates and participants for each workshop and set up the roadmap as workshop objectives with their dates.
In ResGuard: Objective Manager -
5. Initial data protection assessment
Answer the data protection assessment for each entity in scope: compliant, partially compliant, not compliant or not applicable. Confirm the measures you answered as compliant in the action plan, so the compliance score shows where you stand today. Management sees this baseline in Workshop 2.
In ResGuard: Data Protection Assessment -
6. Workshop review & close-out
Review the results with the data protection lead, attach evidence, log open points as new tasks and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind in Chile
- Main law: Law No. 21.719, which substantially reforms Law No. 19.628 on the protection of private life and applies from 1 December 2026. Plan the programme against the new law.
- Authority: the Personal Data Protection Agency (Agencia de Protección de Datos Personales), created by Law No. 21.719, with powers to supervise and sanction.
- The law also applies to controllers and processors outside Chile that offer goods or services to people in Chile or monitor their behaviour.
- Add the relevant sector rules to the scope document, for example the Cybersecurity Framework Law No. 21.663 or the rules on patient rights and banking secrecy.
Expected result
- The project team understands the core concepts and principles
- Applicable laws documented in the data protection scope document
- Data protection scope document approved by management in the Policy Framework
- Project team and roadmap for all 13 workshops set up in the Objective Manager
- Initial data protection assessment completed and baseline compliance score available
ResGuard modules: Policy Framework, Data Protection Assessment, Objective Manager