Guidance · Legal and DPO
If you advise on law and personal data
You are asked whether something must be reported, and to whom. You advise; owners decide.
The decisions you'll be asked to make
When do we…
When does personal data make a security incident a GDPR breach?Treat it as a personal data breach whenever personal data was disclosed to or reached by someone not entitled to it, altered, or lost or out of reach, even for a time.
When do we…
When must we tell people affected by a personal data breach, and what do we tell them?Tell the people affected without undue delay when the breach is likely to result in a high risk to them, unless the data was unintelligible to anyone not authorised, later measures removed the high risk, or a public communication replaces disproportionate individual messages.
When do we…
When do we have to notify a regulator, and under which regime?Screen every declared incident against NIS2, DORA and the GDPR within 4 hours of declaration, the pack's default, starting from an applicability profile made before any incident.
If…, then how…
If a board member asks about their personal liability under NIS2, then what do I say?Say in plain terms what NIS2 asks of the board, and hand the question of personal exposure to legal counsel.
If…, then how…
If an AI vendor may train on our data, then what do we require?For Internal and Confidential information, require a contract term that bars the vendor from using your prompts, files and outputs to train or improve its models or anyone else's.
What you own and what you hand on
From the Information Ownership Responsibility Matrix P15-A09, in Information Classification & Handling.
The Data Protection Officer's column. Where you are consulted, the information owner decides.
You answer for it 1
RS-07 Advise on personal and special category data
Your side Data Protection Officer answers for it
Also involved: Information owner (consulted), Head of Information Security (consulted), Records manager (consulted)
The rule, CL-07Personal data is protected under data protection law (GDPR) regardless of the classification label, and carries the Personal data marker. The label does not decide whether processing is lawful.
Hand it on: you are consulted or told 8
RS-01 Classify a new or changed information asset and record the level
Your side Data Protection Officer is consulted. Answers for it Information owner
Also involved: Custodian (consulted), User (told), Head of Information Security (consulted), Records manager (told)
The rule, CL-03Information owners approve the level and review it when the purpose, users, law, a supplier or the risk changes, within 15 working days of the change.
RS-02 Approve a public release
Your side Data Protection Officer is consulted. Answers for it Information owner
Also involved: Custodian (told), Head of Information Security (consulted), Records manager (told)
The rule, CL-05Public information must have an owner-approved release decision. A lack of a label never makes information Public.
RS-05 Approve sharing Confidential information with a recipient outside the organisation
Your side Data Protection Officer is consulted. Answers for it Information owner
Also involved: User (does it), Head of Information Security (consulted)
The rule, CL-08Confidential information is shared only with an approved recipient for a recorded purpose, using an approved channel, with the recipient's address checked before sending.
RS-06 Check a supplier before it holds Internal or Confidential information
Your side Data Protection Officer is consulted. Answers for it Information owner
Also involved: Custodian (consulted), Head of Information Security (does it)
The rule, CL-16A supplier stores, processes or receives Internal or Confidential information only under contract terms that protect it (P06 clause CL-01, P06 clause CL-07, P06 clause CL-13, and P06 clause CL-06 where it processes personal data). Confidential information goes to a supplier only after its assessment under the third-party pack has ended in a documented decision to approve it (P06 TP-05).
RS-08 Keep the retention schedule
Your side Data Protection Officer is consulted. Answers for it Records manager
Also involved: Information owner (consulted), Head of Information Security (consulted)
The rule, CL-11Dispose of information and media using the level's disposal rule and the method for the media type. Keep a certificate for every Confidential item a provider sanitises or destroys, due within 10 working days of collection, and a disposal record for every item destroyed in house.
RS-09 Apply and release a legal hold
Your side Data Protection Officer is consulted. Answers for it Records manager
Also involved: Information owner (told), Custodian (does it)
The rule, CL-15Information under a legal hold is not changed, deleted or disposed of, whatever its retention period, until Legal releases the hold in writing. Disposal checks for a hold first.
RS-12 Review the register
Your side Data Protection Officer is consulted. Answers for it Head of Information Security
Also involved: Information owner (does it), Custodian (does it), Records manager (consulted)
The rule, CL-12Information owners and custodians review the register at least every 12 months and after a material change.
RS-13 Brief staff on the levels and the handling rules
Your side Data Protection Officer is consulted. Answers for it Head of Information Security
Also involved: Information owner (consulted), User (told)
The rule, CL-06Apply the handling rule for the level to every action: storing, accessing, sharing inside and outside the organisation, transferring, printing, remote and mobile working, AI tools, retaining and disposing.
Underlined values are the pack's defaults: your organisation sets its own when it adopts the document.
This page shows what the pack's matrix assigns to a role. It records nothing about who holds a role in your organisation.