Privacy Program Management and Governance
A privacy programme converts legal obligations into repeatable business operations. DCPP tests operating models, artefacts and evidence, not just policy text.
Operating model
Accountability sits with the board and an accountable executive; a DPO or privacy officer runs the programme with independence and direct reporting lines. A privacy council - legal, security, IT, HR, product, marketing, procurement - decides cross-functional issues. The three-lines model separates product ownership, privacy/security oversight and internal audit. Policy hierarchy: charter, policy, standards, procedures, records.
Core artefacts
- Data inventory and records of processing (ROPA): systems, purposes, categories, recipients, retention, transfers.
- DPIAs for high-risk processing, with sign-off and residual-risk acceptance.
- Privacy risk register linked to enterprise risk.
- Notice and consent records; DSR workflow with SLAs.
- Vendor due diligence and contract clauses.
- Role-based training and completion metrics; audit plan and remediation tracking.
- NIST Privacy Framework or ISO/IEC 27701 as an organising structure.
Worked example
HR proposes an analytics tool scoring employee attrition using engagement, leave and health-insurance data.
- Inventory the data and flag health data as highly sensitive.
- Consider whether consent is realistic in employment; rely on lawful basis and transparency, and avoid covert monitoring.
- Run a DPIA: necessity, minimisation, fairness, employee impact, retention, access.
- Contract the vendor for processor duties, security and deletion.
- Take the DPIA to the privacy council for approval with conditions; schedule a review.
- Record the decision - auditors ask for evidence, not intentions.
Traps
- Treating privacy as a legal-only function.
- Policies with no training, testing or metrics behind them.
- DPIAs performed after go-live.
- Assuming employee consent cures disproportionate monitoring.