Leadership, DPO Independence and Objectives That Cannot Be Measured
Halden Logistics has 2,400 staff across five countries and has been certified to ISO/IEC 27001 since 2021. Its DPO, appointed in 2022, reports to the Chief Marketing Officer, sits on the marketing leadership team and personally approves outbound campaign lists. Privacy objectives for the year read: 'Achieve full GDPR compliance' and 'Zero privacy incidents'. The internal audit programme is outsourced; the provider's scope statement covers the ISMS only, and its last report tested access control and backup restoration. Management review uses the 27001 template: audit results, nonconformities, risk status, actions. Top management signed the privacy policy once, at approval in 2022, and has not discussed privacy since. The gap analysis for the 27701:2025 transition notes that clauses 5, 6.2 and 9 are 'thin'. The compliance lead wants to close the gaps by adding two slides to the management review pack and re-issuing the policy with a new date.
1. Separate the findings into nonconformities and observations, stating the test you apply. Where does 'thin' documentation become a failure of conformity?
Read the worked answer
The test is whether the requirement's intent is met and can be evidenced, not whether a document exists. Nonconformity candidates: (a) DPO independence - if the roles and responsibilities requirement expects privacy accountability to be assigned with authority and without conflicting duties, a DPO reporting to the CMO and approving campaign lists is structurally conflicted, and the organisation cannot show that privacy advice is given independently; (b) internal audit coverage - clause 9.2 requires the audit programme to cover the PIMS, so an ISMS-only scope leaves privacy requirements in clauses 4-10 and the Annex A privacy controls unaudited; that is a failure to implement, not a documentation gap; (c) management review inputs - clause 9.3 requires privacy performance, incidents, risks and audit results as inputs, so a template that excludes them fails the requirement. Observation candidates: policy not discussed since 2022 (weak evidence of commitment, but commitment is judged from decisions and behaviour); objectives phrasing, which is a nonconformity only if no measurable objectives exist at all.
'Thin' becomes failure when there is no evidence the process operates - not when the evidence is brief.
2. What must change about the DPO's position and the evidence of top-management leadership? Give concrete steps and the evidence a transition auditor would accept.
Read the worked answer
Independence first. The DPO should not hold an operational role that determines purposes or means of processing. Move the reporting line to the highest management level or to an independent function such as legal or an audit committee, remove campaign approval from the DPO's duties, and document both the reporting line and the DPO's direct access to top management.
Then rebuild leadership evidence as decisions rather than signatures: a standing privacy item in board or executive minutes with decisions recorded; a resource decision (budget, headcount, tooling) traceable to a privacy risk; a management review where executives challenge residual risk and record acceptance; a policy review cycle triggered by material change. Evidence an auditor accepts: minutes with named attendees and actions; the DPO's escalation log with outcomes; terms of reference for the privacy function; an organisation chart showing the reporting line; and testimony from the DPO that they were not overruled on a matter they flagged. Two slides in an existing pack will not close this; one documented decision that changed something will.
3. Rewrite the privacy objectives so they satisfy clause 6.2 and can be monitored under clause 9.1, and explain why the two current objectives cannot be monitored.
Read the worked answer
Clause 6.2 expects objectives relevant to the PIMS, measurable or verifiable, monitored, communicated and updated. 'Full GDPR compliance' is a legal state, not a target: no baseline, no trend, no way to show improvement. 'Zero privacy incidents' is measurable but misdirected - it rewards non-reporting and says nothing about the quality of processing.
Replacements that work: reduce median time from PII principal request receipt to fulfilment from 21 to 10 working days; complete privacy impact assessments for 100% of new processing activities before go-live, with a target of zero post-launch findings; reduce overdue retention deletions from 4,100 records to under 200 by quarter end; achieve 95% completion of role-based privacy training for staff handling PII, measured quarterly; close 90% of privacy nonconformities within agreed corrective-action dates. Each has an owner, baseline, target, data source and reporting cadence - which is exactly what clause 9.1 monitoring must feed into management review, and it makes the objectives auditable rather than aspirational.