vDPO Services

Flow chart of the vDPO engagement, 5 phases in order, each one selectable. Phase 1, Appointment and Scope. We formally take on the DPO role, agree our remit and reporting lines, and register the point of contact your customers and the regulator can reach. Activities: Formalise the DPO appointment and board reporting line; Publish the point of contact on your notices and website; Confirm your role as data fiduciary or processor per system; Agree the privacy operating model with legal and product. Hands over DPO Appointment Record. Phase 2, RoPA and Data Mapping. We map what personal data you hold, where it flows and why, and build your record of processing activities so nothing is hidden or unaccounted for. Activities: Draft the RoPA with each business unit; Trace personal data flows across systems and vendors; Record the lawful basis and retention period for each purpose; Flag cross-border transfers and processor contracts. Hands over Record of Processing Activities and Data Map. Phase 3, Rights and Consent Operations. We run the day-to-day work of handling data principal requests, managing consent and keeping your notices accurate and honest. Activities: Run data principal requests from intake to response; Verify identity before any data is disclosed; Maintain consent records and withdrawal handling; Keep privacy notices aligned with actual processing. Hands over Data Principal Request Register. Phase 4, Breach Handling. When a personal data breach happens, we assess it, guide containment and manage notification to the regulator and affected people within the required timelines. Activities: Assess the breach against the DPDP Act notification duties; Determine the categories and volume of data affected; Draft notifications to the Data Protection Board and individuals; Record remediation actions and lessons learned. Hands over Breach Assessment and Notification File. Phase 5, Regulator Liaison. We act as your contact with the Data Protection Board and other authorities, responding to queries and demonstrating your compliance calmly and clearly. Activities: Answer regulator queries with evidence from the RoPA; Keep the accountability file ready for inspection; Report privacy programme status to your board; Track changes to the DPDP Act rules and advise on impact. Hands over Regulator Correspondence File. Each phase begins from the artefact the phase before it produced.