GDPR / Data Protection Implementation Pack

GDPR / Data Protection Implementation Pack

Purpose

This workflow implements a data protection compliance program under GDPR (EU) and/or equivalent MENA regimes (UAE Federal Decree-Law 45/2021 on Personal Data Protection; Saudi Arabia's Personal Data Protection Law). The program is structured in twelve phases, spanning a typical 90–180 days for a medium-size organization.

---

Inputs

---

Parallel Regime Map

---

Phase 1 — Data Mapping (Weeks 1–3)

Objective: Know what personal data you hold, where it is, and what you do with it.

Activities:

1. Identify all systems and databases that contain personal data (CRM, HR, marketing platform, cloud storage, analytics, support ticketing, etc.)
2. For each system: identify — categories of personal data; categories of data subjects; purposes of processing; legal basis; retention period; who has access; whether data is shared with third parties; whether data is transferred outside the home country/EEA/UAE
3. Conduct department interviews (HR, marketing, IT, finance, legal) to catch non-obvious processing
4. Document in a Data Inventory / Record of Processing Activities (RoPA) — required under GDPR Art. 30; good practice under MENA regimes

Output: Data inventory spreadsheet / RoPA with at minimum: processing activity name, controller/processor, categories of data, data subjects, purposes, legal basis, transfers, retention, security measures.

---

Phase 2 — Lawful Basis Assignment (Weeks 2–4)

Objective: Assign a valid legal basis to each processing activity.

Available bases under GDPR (compare with MENA regimes):

MENA critical point: Legitimate interests (GDPR Art. 6(1)(f)) is the most flexible basis under GDPR for commercial processing. It is not available under UAE PDPL. UAE-operating organizations relying on legitimate interests for GDPR purposes must identify a different basis (typically consent or contract) for UAE PDPL compliance.

---

Phase 3 — Privacy Notice Rewrite (Weeks 3–5)

Objective: Publish a GDPR/PDPL-compliant privacy notice.

See [[draft-privacy-policy]] for the template. Key required elements under GDPR:

• Identity and contact details of the controller (and DPO if appointed)
• Purposes and legal bases for each category of processing
• Legitimate interests where relied upon (LIA summary)
• Categories of recipients
• International transfers and safeguards
• Retention periods (or criteria for determining them)
• Data subject rights and how to exercise them
• Right to withdraw consent
• Right to lodge a complaint with the supervisory authority

MENA additional requirements:

• UAE PDPL: notice in Arabic (or Arabic alongside English) where data subjects are Arabic speakers
• KSA PDPL: Arabic-language notice; specific disclosures about cross-border transfer consents

---

Phase 4 — Consent Mechanisms (Weeks 4–6)

Objective: Implement granular, revocable consent infrastructure.

GDPR-compliant consent:

• Cookies: PECR (UK) / ePrivacy Directive (EU): consent required for non-essential cookies; cookie banner must allow genuine choice; no pre-ticked boxes; categories must be specific
• Marketing communications: opt-in required for email/SMS marketing; unsubscribe mechanism on every communication
• Optional features: if a product feature processes personal data beyond what is necessary for the core service, it should be consent-based and optional

Technical implementation: a Consent Management Platform (CMP) such as OneTrust, Cookiebot, Usercentrics, or TrustArc should be implemented. The CMP must:

• Record consent (timestamp, mechanism, version of notice shown)
• Allow withdrawal as easily as giving consent
• Distinguish between cookie categories (strictly necessary, functional, analytics, advertising)

---

Phase 5 — Data Subject Rights (DSR) Process (Weeks 5–8)

Objective: Ability to respond to access, rectification, erasure, and other requests within legal timelines.

Process components:

1. Intake channel: email (dpo@company.com), in-app form, or postal address
2. Identity verification: before actioning a request, verify the requester's identity (proportionate to sensitivity of data)
3. Response template: for each right, a standardized response template
4. Tracking: log all requests, date received, date responded, outcome
5. Escalation: when is a request refused? (exemptions under GDPR Art. 12; document the basis)

---

Phase 6 — Breach Response Playbook (Weeks 6–8)

Objective: 72-hour notification readiness.

GDPR breach response:

• Detection → Assessment → Notify must complete within 72 hours (GDPR Art. 33) for notifiable breaches (likely risk to data subjects' rights)
• High-risk breaches additionally require notification to affected data subjects (Art. 34) without undue delay

Playbook elements:

1. Detection procedures: how will breaches be identified? (monitoring, employee reporting, third-party notification)
2. Incident severity classification: minor (no notification needed) / significant (supervisory authority notification) / high-risk (also notify individuals)
3. Notification template: GDPR Art. 33(3) requires: nature of breach; categories and approximate number of data subjects; categories and approximate number of records; contact details of DPO; likely consequences; measures taken or proposed
4. Communication protocols: who is the internal breach response team? who approves notification to authorities?
5. Documentation: all breaches must be documented regardless of whether notification is required (Art. 33(5))

MENA notification timelines:

• UAE PDPL: notify TDRA (Telecommunications and Digital Government Regulatory Authority) "without delay"
• KSA PDPL: notify SDAIA within 72 hours for breaches that harm data subjects

---

Phase 7 — Vendor Data Processing Agreements (Weeks 7–10)

Objective: GDPR-compliant DPAs with all processors.

See [[draft-dpa-gdpr]] for template. Every vendor (processor) that processes personal data on your behalf must have a DPA covering:

• Subject matter, nature, purpose, and duration of processing
• Types of personal data and categories of data subjects
• Processor's obligations: process only on documented instructions; confidentiality; security; sub-processor management; data subject rights assistance; deletion/return on termination; audit rights
• Standard Contractual Clauses (SCCs) for international transfers where applicable

Vendor tier prioritization:

• Tier 1 (high-risk processors): CRM, HR platform, marketing automation, cloud infrastructure, analytics — DPA required immediately
• Tier 2 (standard processors): email service providers, support tools, productivity platforms — DPA required; standard template acceptable
• Tier 3 (low-risk/transient): couriers, professional advisors handling limited data — DPA or appropriate contractual provisions required

---

Phase 8 — International Transfers (Weeks 8–12)

Objective: Legal mechanism in place for all personal data transfers outside the EEA (for GDPR) and outside the UAE/KSA (for MENA regimes).

MENA applicability: UAE PDPL restricts transfers of personal data outside the UAE to countries with an "adequate level of protection" or under specific contractual safeguards. KSA PDPL similarly restricts cross-border transfers. Organizations processing data of UAE or KSA data subjects must review all data flows out of these countries.

---

Phase 9 — Records of Processing (Art. 30) (Ongoing from Phase 1)

The RoPA (Record of Processing Activities) initiated in Phase 1 must be:

• Maintained and kept current
• Available to supervisory authorities on request
• In writing (electronic format is fine)

Organizations with <250 employees are partially exempt from the GDPR Art. 30 obligation (certain conditions apply); however, maintaining a RoPA is good practice regardless of size, and MENA PDPL regimes do not carry this exemption.

---

Phase 10 — DPIA Process (Weeks 8–12)

Objective: Data Protection Impact Assessment capability for high-risk processing.

GDPR Art. 35 requires a DPIA before commencing processing that is "likely to result in a high risk" to individuals, including:

• Systematic profiling
• Large-scale processing of special categories (health, biometrics, criminal records)
• Systematic monitoring of publicly accessible areas
• New technologies

DPIA template elements:

1. Description of the processing and its purposes
2. Assessment of necessity and proportionality
3. Risks to data subjects
4. Measures to address those risks
5. DPO consultation (if appointed)

---

Phase 11 — Training (Weeks 10–16)

Objective: All staff with access to personal data understand their obligations.

Training program:

• All staff: awareness training (what is personal data, why it matters, how to handle data subject requests, how to report a breach) — 1-hour annual module
• Data owners / system administrators: deeper training on their specific systems and obligations
• Legal/compliance team: GDPR/PDPL advanced training; DPO qualification if applicable
• Training records: document completion; required for demonstrating accountability (GDPR Art. 5(2))

---

Phase 12 — Governance (Weeks 12–20)

Objective: Sustainable data protection governance structure.

Elements:

• DPO appointment: mandatory for public authorities; for private sector when large-scale systematic monitoring or large-scale special categories processing occurs; recommended for any significant data processor
• Privacy committee: cross-functional (legal, IT, HR, marketing, product); meets quarterly
• Policy framework: data protection policy; data retention policy; breach response policy; acceptable use policy
• Compliance dashboard: tracks ongoing obligations (DSR response times, breach record, DPA status, training completion)
• Annual review: update the RoPA, re-assess DPIAs for changed processes, renew vendor DPAs

---

Timeline Summary

Total: 90 days minimum for essential compliance (Phases 1–8); 180 days for full program including governance and training.

---

Related Skills

• [[draft-privacy-policy]]
• [[draft-dpa-gdpr]]
• [[review-gdpr-readiness]]
• [[workflow-hire-employee-pack]]
• [[workflow-full-due-diligence-pack]]