Data Protection Program Implementation, Monitoring and Improvement
Domain 4 - Program implementation, monitoring and improvement
This domain tests how a data protection program is operationalized and improved: governance, records, training, incident response, monitoring, and corrective action. Expect questions on evidence, metrics, and the plan-do-check-act cycle.
Core rules
- Build a governance framework: policies, roles, risk register, records of processing (Art. 30), vendor contracts, retention schedules, and privacy by design (Art. 25).
- Operate rights and incidents: DSARs normally within one month, extendable by two; breaches notified to the supervisory authority within 72 hours of awareness unless unlikely to result in risk (Art. 33), and to data subjects if high risk (Art. 34).
- Monitor with meaningful metrics: DSAR timeliness, breach detection and closure, DPIA coverage, training completion, vendor review completion, and audit findings.
- Improve through DPO monitoring, internal audit, management review, corrective actions, and updated risk assessments.
Worked example
A payroll processor suffers a ransomware breach affecting employee bank details. The processor must notify the controller without undue delay. The controller assesses risk and, because bank details can enable fraud, notifies the supervisory authority within 72 hours of becoming aware, documents the decision, and informs affected employees if risk is high. The controller remains accountable even though the processor held the data. Remediation includes credential review, segmentation, and a vendor audit.
Traps
Counting 72 hours from the attack rather than awareness; letting a processor notify the authority on the controller's behalf without a clear mandate; treating annual training as sufficient evidence; measuring policy existence rather than effectiveness; closing incidents without root-cause follow-up.