Governance, Roles & DPO
This workshop builds the data protection organisation: management commitment, a responsible person (DPO or delegado de protección de datos), clear responsibilities across the organisation and regular reporting to management.
Workshop 2 video
Walkthrough of the workshop and its tasks — coming soon
What ResGuard provides
- Template for roles and responsibilities (RACI)
- Compliance score and data protection report for management, downloaded with one click
- Organisation setup with departments and employees, also by file import
- Guidance for the DPO appointment and the management meeting in every task
Workshop tasks
-
1. Management meeting: Workshop 1 results
Meet with management to present the results of Workshop 1, especially the applicable laws, the current compliance score from the assessment and the roadmap for the 13 workshops. Agree on budget and resources, get the roadmap approved and keep the minutes as evidence.
In ResGuard: Policy Framework, Data Protection Assessment, Objective Manager -
2. Appoint a DPO or lead
Check whether the law requires a DPO, choose an internal or external person with enough knowledge and time, avoid conflicts of interest and publish the contact details where required.
-
3. Define roles & responsibilities
Build a RACI matrix for management, the DPO, information security, process owners and key functions such as HR, IT and marketing. Start from the roles and responsibilities template in the Policy Framework and adapt it to your organisation.
In ResGuard: Policy Framework -
4. Reporting & governance meetings
Define quarterly reports, an annual report and escalation paths for urgent matters. The reports are generated in ResGuard: download the data protection report with the Download button on the Data Protection Dashboard.
In ResGuard: Data Protection Dashboard -
5. Set up the organisation in ResGuard
Under Organization, click Setup next to each entity: create the departments with their owners, then add the employees with name and email and assign them to their departments, or import the whole list. The following workshops build on them, for example for processing activities, policy acknowledgement and training.
In ResGuard: Organization → Setup -
6. Workshop review & close-out
Review the results, attach evidence, log open points and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind in Chile
- Law No. 21.719 allows organisations to adopt a voluntary infringement prevention model with a data protection officer (delegado de protección de datos). A certified model can be taken into account as a mitigating circumstance for sanctions.
- The officer needs autonomy, resources and direct access to management; the role can be internal or external.
- An outsourced DPO can cover the role while internal staff are being trained.
Expected result
- Workshop 1 results presented to management and roadmap approved
- DPO or data protection lead appointed
- RACI matrix for all key functions documented in the Policy Framework
- Governance meetings scheduled and the first data protection report downloaded
- Departments and employees of every entity set up in ResGuard
ResGuard modules: Policy Framework, Data Protection Dashboard, Organization