Chapter 37 — Privacy and data protection: operations
Lesson map
Lesson 37 published. Map, example, EX109.
flowchart TD
N0["Learning outcomes"]
N1["37.1 A privacy operations function"]
N2["37.2 Rights at volume"]
N3["37.3 Monitoring"]
N4["37.4 Continuous improvement"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX109"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["37.1 A privacy operations function"]
N2["37.2 Rights at volume"]
N3["37.3 Monitoring"]
N4["37.4 Continuous improvement"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX109"]
[Learning outcomes]
|
v
[37.1 A privacy operations function]
|
v
[37.2 Rights at volume]
|
v
[37.3 Monitoring]
|
v
[37.4 Continuous improvement]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX109]
Learning outcomes
You will (1) run privacy operations day to day; (2) handle rights requests at volume; (3) operate monitoring and response.
37.1 A privacy operations function
By now Pellmore's privacy controls need daily operation. Zara helps set up a small privacy operations function in the data protection officer's team. It handles rights requests, reviews access anomalies, monitors retention and consent reconciliation, and coordinates with security on incidents. She writes runbooks for each task with steps, tools and escalation routes. The function reports monthly using the metric set from Chapter 29. Operations, she notes, are where designs either work as intended or quietly decay over time. Its staff own every runbook.
37.2 Rights at volume
Pellmore now receives about two hundred rights requests a month. Zara automates identity checks through account login, data collection through the privacy platform and deadline tracking with alerts at twenty and twenty-five days. Complex requests, such as those involving several family members, go to a specialist. She measures on-time completion and finds that 97% of requests are answered within thirty days. EDPB Guidelines 01/2022 on access inform the process, including how to handle requests from third parties acting for a patient. Requests are logged with deadlines.
37.3 Monitoring
Anomaly signals for access are reviewed daily. In the first month the team reviews thirty alerts; twenty-six are legitimate, such as covering colleagues, and four lead to conversations about access need. One case is a clinician viewing a relative's record, which is handled under Pellmore's disciplinary policy and recorded as a potential breach for assessment. Zara adjusts thresholds to reduce false alarms without missing such cases. She learns that monitoring works only when reviews are prompt and fair to staff. Reviews happen within days.
37.4 Continuous improvement
Each quarter the privacy operations team reviews incidents, metrics and complaints and proposes improvements. Zara facilitates the first review. The team finds that postal rights requests are still slow and that a confusing notice causes many questions. They propose a scanning workflow and a rewritten notice section. ISO/IEC 27701:2025, structured as a management system standard, expects such cycles of monitoring, review and improvement. She notes that the cycle keeps privacy alive as an operating discipline rather than a project that ends. ISO/IEC 27701 builds on this cycle.
Worked example
Zara sets up privacy operations with runbooks, automates rights requests to 97% on time, reviews thirty access alerts including one relative-snooping case and runs a quarterly improvement review.
Synthetic case. Volumes and cases are synthetic; EDPB Guidelines 01/2022 and ISO/IEC 27701:2025 are real.
Errors and limits
Automation can mis-identify requesters; keep a manual route for edge cases.
Exercises
- EX109 — On-time rate. What share of rights requests was answered on time? Rubric: 3 = 97%;; 2 = nearly all;; 1 = wrong;; 0 = none.
- EX110 — Relative's record. How is a clinician viewing a relative's record handled? Rubric: 3 = disciplinary process and assessment as a potential breach;; 2 = one part;; 1 = ignored;; 0 = none.
- EX111 — Management cycle. What does the quarterly review provide? Rubric: 3 = a monitor-review-improve cycle expected of a management system;; 2 = mentions improvement;; 1 = vague;; 0 = none.
Synthesis
Chapter 37 operates privacy. Chapter 38 validates that the system meets real needs.
Continue studying — chapter 37 of 50
← Chapter 36 (draft) · Course chapter index · Chapter 38 (draft) →