Task 7 — Workshop Review & Close-out
Can every process owner answer these questions for their activities?
Expected result of Workshop 3: all processing activities of all departments are recorded with data, data subjects, purpose, legal basis, retention period, transfers and an owner.
- Marketing records "Customer data — for business purposes". What is missing?
- The application form asks for date of birth and a photo. Are they needed for the purpose?
- A customer unsubscribes from the newsletter. What happens to their consent record?
- IT moves the file server to a cloud provider abroad. Which RoPA entries change?
- Which records requirement applies to you in Cyprus?
- Confirm the expected result of every task together with the data protection lead
- Attach evidence to the completed tasks: interview notes, RoPA export, consent records
- Record open points as new tasks with an owner and a due date
- Set all tasks and the objective Data Protection Workshop 3 to completed
- Next: Workshop 4 — Privacy Notices & Transparency, which builds directly on this RoPA