A programme of work is a really useful tool to assist an organisation in complying with its legal and regulatory obligations under data protection law. A programme of work will set out data protection compliance tasks that need to be completed throughout the year and track their progress. They are flexible tools which can be tailored to the level of complexity of the data processed and the scope of an organisation’s legal and regulatory obligations.
A programme of work is a central place to record data protection related actions which can give you a great overview of how your business is performing in this regard. Typically, a data protection programme of work will monitor the progress of data protection activities such as reviews of policies and procedures, DPIAs, LIAs, training and compliance monitoring, as well as being a central “to do” list.
The most effective way to use a programme of work is to ensure it is reviewed on a regular basis, ideally every 1-2 weeks, to ensure all necessary tasks are completed. This will encourage accountability, pushing actions forward to completion.
As well as helping you to get organised, a programme of work can help you reduce data protection risk. For example, having a programme of work in place can help to ensure that an organisation has up to date policies and procedures in place which will guide staff and provide them with clear instructions on how personal data should be stored, processed and protected.
If you would like any assistance in creating or managing your organisation’s data protection programme of work then please get in touch here.
