Workshop 2
Governance, Roles & DPO

Back to the DPO Guide

Governance, Roles & DPO

This workshop builds the data protection organisation: management commitment, a responsible person (DPO or Personal Data Officer), clear responsibilities across the organisation and regular reporting to management.

Workshop tasks

1. 1. Management commitment

   Present the objectives, risks and applicable laws to management. Agree on budget and resources and obtain a written statement supporting the programme.

2. 2. Appoint a DPO or lead

   Check whether the law requires a DPO, choose an internal or external person with enough knowledge and time, avoid conflicts of interest and publish the contact details where required.

3. 3. Define roles & responsibilities

   Build a RACI matrix for management, the DPO, information security, process owners and key functions such as HR, IT and marketing.

4. 4. Reporting & governance meetings

   Define quarterly reports and an annual report, their content (progress, incidents, requests, risks) and escalation paths for urgent matters.

5. 5. Document the organisation

   Summarise commitment, appointment, RACI and reporting in a data protection organisation document and approve it in the Policy Framework.

   In ResGuard: Policy Framework

6. 6. Workshop review & close-out

   Review the results, attach evidence, log open points and close the objective in ResGuard.

   In ResGuard: Objective Manager

Expected result

• Management commitment documented and communicated
• DPO or data protection lead appointed
• RACI matrix defined for all key functions
• Reporting and governance meetings scheduled

ResGuard modules: Policy Framework, Data Protection Dashboard