Governance, Roles & DPO
This workshop builds the data protection organisation: management commitment, a Data Protection Officer (DPO), clear responsibilities across the organisation and regular reporting to management.
Workshop 2 video
Quick intro with a screen recording of the tasks — coming soon
What ResGuard provides
- Template for roles and responsibilities (RACI)
- Compliance score and data protection report for management, downloaded with one click
- Organisation setup with departments and employees, also by file import
- Guidance for the DPO appointment and the management meeting in every task
Workshop tasks
-
1. Management meeting: Workshop 1 results
Meet with management to present the results of Workshop 1, especially the applicable laws, the current compliance score from the assessment and the roadmap for the 13 workshops. Agree on budget and resources, get the roadmap approved and keep the minutes as evidence.
In ResGuard: Policy Framework, Data Protection Assessment, Objective Manager -
2. Appoint the DPO
Designate one or more individuals as DPO, internal or external, with enough knowledge, time and access to management. Avoid conflicts of interest and publish the DPO's business contact information.
-
3. Define roles & responsibilities
Build a RACI matrix for management, the DPO, information security, process owners and key functions such as HR, IT and marketing. Start from the roles and responsibilities template in the Policy Framework and adapt it to your organisation.
In ResGuard: Policy Framework -
4. Reporting & governance meetings
Define quarterly reports, an annual report and escalation paths for urgent matters. The reports are generated in ResGuard: download the data protection report with the Download button on the Data Protection Dashboard.
In ResGuard: Data Protection Dashboard -
5. Set up the organisation in ResGuard
Under Organization, click Setup next to each entity: create the departments with their owners, then add the employees with name and email and assign them to their departments, or import the whole list. The following workshops build on them, for example for processing activities, policy acknowledgement and training.
In ResGuard: Organization → Setup -
6. Workshop review & close-out
Review the results, attach evidence, log open points and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind under the PDPA
- Every organisation must designate at least one individual responsible for ensuring PDPA compliance, regardless of its size. The DPO's responsibilities can be delegated to an external service provider, but legal responsibility stays with the organisation.
- The business contact information of at least one DPO must be made available to the public. The PDPC encourages registering it through ACRA's BizFile+.
- The PDPC's guide to developing a Data Protection Management Programme (DPMP) is a useful structure for the governance document.
Expected result
- Workshop 1 results presented to management and roadmap approved
- DPO appointed and business contact information published
- RACI matrix for all key functions documented in the Policy Framework
- Governance meetings scheduled and the first data protection report downloaded
- Departments and employees of every entity set up in ResGuard
ResGuard modules: Policy Framework, Data Protection Dashboard, Organization