Scope and ownership

Required

• Keep a register of every duty that applies

  Required

  Keep one register in the repository of every law, standard and contract duty you screened. Give each its decision, reason, owner and next review date.

• Derive scope from recorded facts

  Required

  Store the facts that decide which laws apply, such as headcount, turnover, countries served and product types, and compute each threshold in code.

• Give every duty one named owner

  Required

  Give every duty, control and register one named person as owner and one as deputy. A team name is not an owner.

• Keep every legal date in one calendar

  Required

  Generate one calendar from the registers with every review date, contract renewal, legal start date and audit certificate expiry. Warn owners 30 days before each. Audit certificates include ISO 27001. TLS certificates follow certificate renewal instead.

• Decide whether you need a data protection officer

  Required

  Record whether GDPR Article 37 requires a data protection officer, with the reason. If it does, publish the contact and tell the supervisory authority.

• Name a representative when you serve the EU from outside

  Required

  If you have no EU office but offer goods or services to people in the EU, appoint an EU representative in writing. GDPR Article 27 requires it.