Art.38 Position of the data protection officer
Ensure the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data. Support the officer in performing the Article 39 tasks by providing the reso
5
artefacts
0
held by a system
3
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of timely involvement, such as standing membership of change, project and incident forums with attendance records · HR system / LMS
- The reporting line as documented and as actually practised, including direct access to the highest management level and records of that access being used · Document repository
- The conflict of interests assessment for any other duties the officer holds, refreshed when those duties change · Document repository
governing documentDocuments that govern the control
- The resource position: budget, staff, training days and system access rights granted to the officer · Policy repository / GRC workspace
- Terms of engagement evidencing protection from dismissal or penalty for performing the tasks · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- The officer consulted after decisions are taken, at approval rather than at design, which is not timely involvement
- A reporting line to the highest management level that exists on paper and has never been used, with all real reporting through a manager whose work the officer must assess
- The role held alongside responsibility for the systems and processing being assessed, which the Article treats as a conflict of interests
- No budget or training allocation, so maintaining expert knowledge depends on the officer's own time
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.37 Designation of the data protection officer · Art.39 Tasks of the data protection officer