◇ OpenCyber Academy
Professional · Chapter 3 · English

Chapter 3 — Roles and responsibilities

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Roles and responsibilities

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Keeping roles simple"]
  N2["3.2 Assigning roles"]
  N3["3.3 Role descriptions"]
  N4["3.4 Making it stick"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Keeping roles simple"]
  N2["3.2 Assigning roles"]
  N3["3.3 Role descriptions"]
  N4["3.4 Making it stick"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX011"]

[Learning outcomes]
    |
    v
[3.1 Keeping roles simple]
    |
    v
[3.2 Assigning roles]
    |
    v
[3.3 Role descriptions]
    |
    v
[3.4 Making it stick]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) define governance roles for a small charity; (2) assign them realistically; (3) write simple role descriptions.

3.1 Keeping roles simple

Mr. Nowak explains that small organisations need simple roles. A trustee takes oversight of data on behalf of the board. A data lead, Grace, coordinates governance day to day. Owners are managers responsible for each kind of data: the fundraising manager for donors, the volunteer coordinator for volunteers and the food bank leads for client referrals. Volunteers and staff follow the rules. Grace notes that clear names matter more than impressive titles. Grace writes the roles in a short table with one line for each person and the data they look after.

3.2 Assigning roles

Grace proposes the roles to trustees. One trustee with legal experience agrees to oversee data. The fundraising manager accepts ownership of donor data. Food bank leads accept ownership of client referrals, with Grace setting common rules. Grace checks whether Northbank must appoint a data protection officer and finds that its large-scale processing of special category data may require one. She raises it with the trustee, who arranges external advice. The advice confirms that an external officer should be appointed, and the board agrees to arrange one on a part-time contract.

3.3 Role descriptions

Grace writes a short description for each role: what decisions it makes, what it must check and who it reports to. The food bank lead's description includes deciding which volunteers may see referrals, checking that paper forms are locked away and reporting problems to Grace within a day. She keeps each description to half a page. Mr. Nowak notes that short descriptions are more likely to be read and followed. Each owner reads and signs their description, and Grace keeps the signed copies with the data policy for reference.

3.4 Making it stick

Grace adds data responsibilities to volunteer induction, so new volunteers learn who to ask. She adds a standing data item to the monthly leads meeting. She also asks the trustee to report on data at each board meeting. Mr. Nowak explains that roles become real when they appear in routines such as inductions and meetings, rather than existing only in a document nobody revisits. After three months, Grace finds that leads raise data questions at most monthly meetings, which shows that the routine is working and that leads now see data as part of their job.

Worked example

Grace defines trustee, data lead, owner and volunteer roles, assigns them with a legal trustee overseeing, raises the possible need for a data protection officer and embeds roles in inductions and meetings.

Synthetic case. Roles are synthetic; the GDPR is real.

Errors and limits

Copying large-company role structures into a small charity creates unfilled posts.

Exercises

Continue studying — lesson 03 (chapter 03 of 12)

← Chapter 02 · Course chapter index · Chapter 04 →

Continue to the next authored lesson.