DPO, privacy owner, legal adviser and security lead

Start with a responsibility map

A privacy owner can coordinate the programme; operational teams carry out changes; security specialists assess and manage technical safeguards; qualified legal advisers address legal interpretation within their scope. A DPO role has its own mandate and applicable requirements.

Ask four questions for each activity

For a new data use, a rights request or a supplier change, make the handover explicit.

• Who gathers the facts and recommends a response?
• Who has authority to approve the decision?
• Who carries out the change and confirms completion?
• Who checks the result and receives unresolved concerns?

Example: a new support provider

The business owner explains the purpose. Procurement and security collect supplier information. Privacy and legal reviewers identify relevant questions. The authorised owner approves the arrangement and operations implement it.

Record the appointment boundary

Advice, a public contact role and a formal appointment must be described accurately. The DPDP SDF appointment question requires the actual notification and mandate to be reviewed; an enquiry or assessment report does not establish either.