Role guide
Compliance and data protection officers
Compliance usually runs the company plan: tracking what applies, who owns what, and whether the evidence would satisfy a reviewer. Ownership of individual controls stays with the delivering functions.
How to read this page. The obligations belong to your organisation, not to a role or a sector. Everything here is practical emphasis: which official duties this audience usually leads or feeds into, with links to the official text. Finishing one function's work never makes the company compliant by itself.
Work your function usually leads
Published contact for data questionsRule 9, official text →
Publishing the contact who can answer processing questions, and keeping it in every rights response, is usually a compliance owned control.
Rights and grievance machineryRule 14, official text →
The published request channels and the grievance response system are the backbone of individual facing compliance.
Significant Data Fiduciary dutiesRule 13, official text →
If notified as significant, the annual impact assessment, audit and Board reporting cycle is run from compliance.
Work your function usually feeds into
Breach reporting to the BoardRule 7, official text →
The staged Board intimation is usually filed by compliance on facts from security.
Retention schedule governanceRule 8, official text →
Compliance keeps the retention schedule honest; engineering executes it.
Tools for this role
Tool
Compliance Plan
Generate one company level action plan and see the work for your role first.
Open
Tool
Privacy Notice Checker
Check whether your notice covers the elements the DPDP sources require.
Open
Tool
Vendor and Processor Checklist
Identify DPDP relevant actions for your vendors and Data Processors.
Open