DPO Guide
Data Protection in Peru

Your starting point in data protection

This guide is for people who take on data protection within their organisation, whether as Personal Data Officer, compliance lead or member of the data protection team, and who are new to the topic.

The programme is split into 13 workshops. Each workshop has a clear objective, a set of concrete tasks and a result you can verify. The introduction video explains how the guide is built and how to get the most out of it.

How to use this guide

1. Follow the workshops in order. Each workshop builds on the results of the previous ones, especially the records of processing from Workshop 3.
2. Watch the video for each workshop. Every page includes a video explaining the workshop and its tasks.
3. Work through the tasks with your team. Involve HR, IT, sales and marketing; data protection is not just the DPO's job.
4. Document in ResGuard. Each workshop is available in the platform as an objective with tasks, with templates in the policy library.
5. Close out each workshop. Review the result, attach evidence and log open points before moving on.

The 13 workshops

Foundations

1. 1 Introduction & Applicable Laws Core concepts, applicable laws, programme scope and project team. 6 weeks
2. 2 Governance, Roles & DPO Management commitment, DPO appointment, RACI matrix and reporting to management. 7 weeks

Inventory & transparency

1. 3 Records of Processing Activities Inventory of all processing: data, data subjects, purpose, legal basis and retention. 8 weeks
2. 4 Privacy Notices & Transparency Inform each group of data subjects where their data is collected. 6 weeks

Rules & rights

1. 5 Data Protection Policies Overall policy, supporting procedures, approval and employee acknowledgement. 7 weeks
2. 6 Data Retention & Deletion Retention schedule, deletion methods and regular reviews. 7 weeks
3. 7 Data Subject Requests (ARCO) Intake channels, identity checks, procedure and response deadlines. 7 weeks

Risk, security & third parties

1. 8 Risk Assessment & DPIA Find high-risk processing, assess it and apply privacy by design. 7 weeks
2. 9 Technical & Organisational Measures Assess security measures, close gaps and document them. 6 weeks
3. 10 Vendors, Processors & Applications Application and vendor inventory, assessments, contracts and transfers. 8 weeks
4. 11 Data Breach Management Detect, assess and report incidents affecting personal data. 7 weeks

Culture & continuous improvement

1. 12 Awareness & Training Role-based training plan, tracking and ongoing awareness. 7 weeks
2. 13 Monitoring, Audits & Continuous Improvement Key indicators, internal audits, corrective actions and annual management review. 7 weeks

Need support?

If your team needs guidance, our Outsourced DPO service can take on the DPO role or support your internal lead throughout the programme.