Chapter 29 — Privacy and data protection: operations | Bachelor's Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 29 — Privacy and data protection: operations

Lesson map

Lesson 29 published. Map, example, EX085.

flowchart TD
  N0["Learning outcomes"]
  N1["29.1 Operations calendar"]
  N2["29.2 Requests and incidents"]
  N3["29.3 Metrics"]
  N4["29.4 Sustaining"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX085"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["29.1 Operations calendar"]
  N2["29.2 Requests and incidents"]
  N3["29.3 Metrics"]
  N4["29.4 Sustaining"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX085"]

[Learning outcomes]
    |
    v
[29.1 Operations calendar]
    |
    v
[29.2 Requests and incidents]
    |
    v
[29.3 Metrics]
    |
    v
[29.4 Sustaining]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX085]

Learning outcomes

You will (1) run day-to-day data protection operations; (2) handle rights requests and incidents; (3) report to leadership.

29.1 Operations calendar

Elena helps the data protection lead create an operations calendar. Weekly: review the request inbox and incident log. Monthly: report metrics and review new apps. Termly: access reviews, training checks and restore tests. Yearly: update the record of processing and retention schedule. The calendar turns many separate tasks into a predictable routine, which is important in schools where staff time is limited and priorities change quickly. Each month lists due tasks and owners, such as access reviews in September and retention deletion in July.

29.2 Requests and incidents

With the central inbox, requests are logged and assigned on arrival. Elena handles a request from a parent who wants all data about their child, including emails mentioning the child. She works with the data protection lead to search email systems and redact information about other pupils. She learns that access requests often involve judgement about third-party information, and that EDPB Guidelines 01/2022 discuss how to balance rights of others. Redaction protects other pupils. Other pupils' details are removed before any record is released.

29.3 Metrics

Elena reports monthly metrics to leadership: requests received and on time, incidents and time to report, apps vetted and rejected, access review completion and training completion. She presents trends with brief explanations. Leadership asks for fewer numbers and more meaning, so she adds a short paragraph on what changed and what needs attention. She learns that metrics are useful only when someone acts on them. Her monthly page shows five figures with a comment on each. Five figures fit on one page.

29.4 Sustaining

Elena notes that operations depend on the data protection lead, a single person. If the lead is ill, tasks stop. She recommends a deputy and documented procedures. She also recommends that each school name a privacy champion who handles local questions and escalates issues. Dr. Asante points out that resilience applies to people as well as systems, and that small organisations are especially vulnerable to losing key individuals. Each role now has a written procedure and a trained deputy. Cover is now planned.

Worked example

Elena creates an operations calendar, handles an access request involving redaction of other pupils, reports monthly metrics with commentary and recommends a deputy and school privacy champions.

Synthetic case. Operations are synthetic; EDPB Guidelines 01/2022 are real.

Errors and limits

Champions need time and training; naming them is not enough.

Exercises

EX085 — Calendar purpose. What does the operations calendar achieve? Rubric: 3 = turns separate tasks into a predictable routine;; 2 = mentions routine;; 1 = vague;; 0 = none.
EX086 — Redaction. Why redact parts of emails in an access request? Rubric: 3 = they contain information about other pupils;; 2 = mentions others;; 1 = send all;; 0 = none.
EX087 — Single point. What single point of failure does Elena identify? Rubric: 3 = the data protection lead as the only person running operations;; 2 = mentions lead;; 1 = vague;; 0 = none.

Synthesis

Chapter 29 runs operations. Chapter 30 is the second laboratory.

Continue studying — chapter 29 of 40

← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →