Chapter 7 — Privacy and data protection: organizational integration
Lesson map
Lesson 07 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Product process"]
N2["7.2 Procurement"]
N3["7.3 Alignment"]
N4["7.4 Champions"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Product process"]
N2["7.2 Procurement"]
N3["7.3 Alignment"]
N4["7.4 Champions"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX031"]
[Learning outcomes]
|
v
[7.1 Product process]
|
v
[7.2 Procurement]
|
v
[7.3 Alignment]
|
v
[7.4 Champions]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) embed privacy in product and procurement processes; (2) align privacy with security and risk functions; (3) build a network of privacy champions.
7.1 Product process
Priscila integrates privacy into Corvina's product process. Each product change passes a short screening: does it collect new data, use data for a new purpose, involve a new vendor or affect many customers? A yes triggers a full DPIA. This closes the gap found in Chapter 2, where changes to existing products escaped review. In the first quarter, screening triggers three DPIAs, including one for changes to the fraud model. Screening uses these four yes-or-no questions, about new data, new purposes, new vendors and scale.
7.2 Procurement
Vendors receive personal data. Priscila adds privacy criteria to procurement: data processing agreements meeting GDPR Article 28 and LGPD requirements, deletion terms, sub-processor lists and breach notification times. EDPB Guidelines 07/2020 help her define when a vendor is a processor or a controller. Procurement now cannot sign contracts involving personal data without privacy review, which prevents gaps rather than finding them later. The review takes at most five working days, and a standard questionnaire covers security, subprocessors, transfers, retention and support for rights requests, so procurement staff know exactly what to collect before contacting the privacy team.
7.3 Alignment
Priscila meets the security and enterprise risk teams monthly. They share incident data, align risk ratings and coordinate on vendor reviews. The security team adopts her individual-harm column in their breach assessments. She notes that privacy, security and risk functions often duplicate work or leave gaps between them, and that regular coordination makes the organisation's protection more coherent and less burdensome for teams who must answer all three. Priscila, the security lead and the compliance officer now meet monthly and share one register of open actions.
7.4 Champions
Priscila builds a network of privacy champions, one in each department, trained to answer basic questions and spot issues. Champions meet quarterly and share examples. She finds that champions catch problems early, such as a customer service team sharing screenshots containing card numbers in internal chat. Dr. Ward notes that a small privacy team can extend its reach through champions, as long as they receive training, time and recognition. Each champion receives two hours of training each quarter. Their names appear on the intranet privacy page.
Worked example
Priscila adds change screening that triggers three DPIAs in a quarter, embeds privacy in procurement, coordinates monthly with security and risk and builds a champion network that spots screenshot sharing.
Synthetic case. Processes are synthetic; GDPR Article 28, LGPD and EDPB Guidelines 07/2020 are real.
Errors and limits
Screening questions can be answered carelessly; spot-check answers.
Exercises
- EX031 — Screening triggers. Name two screening questions that trigger a DPIA. Rubric: 3 = new data, new purpose, new vendor or many customers affected;; 2 = one;; 1 = vague;; 0 = none.
- EX032 — Procurement criteria. What privacy criteria were added to procurement? Rubric: 3 = Article 28-compliant agreements, deletion terms, sub-processor lists and breach times;; 2 = two;; 1 = vague;; 0 = none.
- EX033 — Champion catch. What did champions catch early? Rubric: 3 = screenshots with card numbers in internal chat;; 2 = mentions screenshots;; 1 = vague;; 0 = none.
- EX034 — Coordination value. Why coordinate privacy, security and risk monthly? Rubric: 3 = avoids duplication and gaps, making protection coherent;; 2 = mentions alignment;; 1 = unnecessary;; 0 = none.
- EX035 — Fraud DPIA. Which existing product change triggered a DPIA? Rubric: 3 = changes to the fraud model;; 2 = mentions fraud;; 1 = vague;; 0 = none.
Synthesis
Chapter 7 integrates privacy. Chapter 8 handles difficult cases.
Continue studying — chapter 07 of 12
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →