<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-data-protection-officer-workflows
description: >-
  Manage DPO responsibilities including ROPA maintenance, breach tracking, DPIA oversight, and regulatory response under GDPR and equivalent frameworks.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - dpo
  - gdpr
  - ropa
  - dpia
  - breach-notification
  - regulatory-compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  frameworks: ["GDPR", "CCPA", "LGPD", "PDPA"]
---

# Performing Data Protection Officer Workflows

## Overview

The DPO function under GDPR Art. 37-39 requires independent oversight of data protection compliance, risk management, and regulatory liaison. This skill covers the operational workflows: maintaining the Record of Processing Activities (ROPA), managing Data Protection Impact Assessments (DPIAs), coordinating breach notifications, and handling data subject rights requests.

Mode: `[MODE: PRIVACY]` — Regulatory compliance. Document reasoning for every decision.

## DPO Responsibility Matrix

| Responsibility | Regulation | Cadence | Output |
|---|---|---|---|
| ROPA maintenance | GDPR Art. 30 | Ongoing, full review quarterly | Updated ROPA register |
| DPIA oversight | GDPR Art. 35 | Before high-risk processing | DPIA approval/rejection record |
| Breach notification | GDPR Art. 33/34 | 72h to SA, undue delay to subjects | Notification to DPA + subjects |
| DSR response | GDPR Art. 15-22 | Within 30 days (extendable to 90) | Fulfillment or reasoned refusal |
| Regulatory liaison | GDPR Art. 39 | On supervisory authority contact | Correspondence records |
| Training | GDPR Art. 39(1)(b) | Annual minimum | Training completion records |

## ROPA Required Fields (Art. 30)

| Field | Controller Obligation | Processor Obligation |
|---|---|---|
| Controller/processor name and contact | Required | Required |
| DPO contact | Required | Required |
| Processing purposes | Required | — |
| Data subject categories | Required | — |
| Data categories | Required | Required |
| Recipients / third countries | Required | Required |
| Retention periods | Required | — |
| Security measures | Where possible | Where possible |

## DPIA Trigger Assessment

| Processing Activity | DPIA Required? | Basis |
|---|---|---|
| Large-scale biometric processing | Yes | GDPR Art. 35(3)(b) |
| Systematic monitoring of public areas | Yes | GDPR Art. 35(3)(c) |
| Profiling with legal/significant effect | Yes | GDPR Art. 35(3)(a) |
| Processing children's data at scale | Yes | EDPB guidelines |
| New technology with unclear risk | Likely | GDPR Art. 35(1) |
| Existing process, no changes | No (unless risk changed) | Art. 35(1) threshold |

## Breach Response Timeline

| Time | Action | Owner |
|---|---|---|
| T+0 | Incident confirmed as personal data breach | IR Team |
| T+4h | DPO notified, initial risk assessment started | DPO |
| T+24h | Risk assessment complete — notify DPA or document no-notify rationale | DPO + Legal |
| T+72h | DPA notification filed (if required) | DPO |
| T+undue delay | Subject notification (if high risk to rights/freedoms) | DPO + Comms |
| T+30d | Post-incident review and ROPA update | DPO |

## Data Subject Rights Workflow

| Right | Article | Response Deadline | Complexity |
|---|---|---|---|
| Access (SAR) | Art. 15 | 30 days (+ 60 day extension) | High — requires full data map |
| Rectification | Art. 16 | 30 days | Medium |
| Erasure ("right to be forgotten") | Art. 17 | 30 days | High — check exemptions |
| Restriction | Art. 18 | 30 days | Medium |
| Portability | Art. 20 | 30 days | High — machine-readable export |
| Object to processing | Art. 21 | Immediate for direct marketing | Low-Medium |

## Workflow

1. Maintain ROPA as a living register — trigger review on new systems or process changes
2. Screen all new processing activities against DPIA trigger list
3. For triggered DPIAs: scope, document, consult stakeholders, assess residual risk, record decision
4. On breach discovery: confirm scope, assess risk, file with DPA within 72h if required
5. Route DSRs to data owners, track fulfillment deadlines, respond in writing
6. Provide annual privacy training for all staff handling personal data
7. Maintain consultation record with supervisory authority

## Related Techniques

- [Performing Data Protection Impact Assessment](../conducting-data-protection-impact-assessment/SKILL.md)
- [Implementing Privacy by Design](../implementing-privacy-by-design/SKILL.md)
