What the governing body should ask about the organization's privacy, data protection, cross-border transfers, and breach response

Authority disclaimer. This page is an executive narrative. It does not establish requirements; the linked corpus governs. It is provided to support understanding, discussion, and decision-making by the governing body and accountable executive leadership (board, ELT, or senior management, as applicable). It creates no obligation, control, or assurance by itself. Its publication approval is an editorial act only and confers no authority over any corpus document. Where it differs from a corpus document, the corpus document prevails.

Oversight works through questions paired with evidence expectations. A question with no stated evidence expectation leaves only a narrative answer; each question below therefore carries a note on what a strong answer contains, so the reader can tell evidence from reassurance. The privacy management programme charter establishes the organizational structure and accountabilities for personal data protection. This page routes to the corpus instruments governing data privacy, cross-border transfers, and breach response. Use this page when examining management's operating evidence in four areas: governance and independence, privacy by design and cross-border transfers, data subject rights, and breach response.

For each area, the corpus defines the register, record, or procedure a strong answer draws on, and each note below points to where. The pairing of a question with an evidence expectation is a composite reading across the sources this page lists; the limitations say so.

The questions are entity-neutral. They presume nothing about whether the asking body is a board, a board committee, or senior management holding the equivalent authority.

Theme: governance and independence. Who oversees privacy, and are they structurally protected?

• Who holds the operational ownership of the privacy programme, and how is their independence protected from IT and operations? A strong answer produces the role designation and reports the conflict-of-interest mitigations or formal exemption. The privacy management programme charter defines the independence requirements and conflict-of-interest constraints for the role it names (its DPO independence and conflict of interest section), which a strong answer is measured against.
• Where we process personal data from jurisdictions requiring local representation, who holds those mandates? A strong answer produces the written mandate for each regional representative. The privacy management programme charter sets the trigger criteria and the designation process for these roles (its EU representative section).

A weak answer in this theme: an IT operations executive holding the privacy leadership role without documented mitigation controls or formal exemption analysis, blending operations interest with privacy oversight.

Theme: privacy by design and cross-border transfers. How do we assess risk before processing begins?

• When we launch a new system, AI model, or processing activity, how do we evaluate its privacy impact? A strong answer produces completed privacy impact assessments. The privacy impact and cross-border transfer procedure defines the mandatory triggers for an assessment before data collection begins (its Step 1).
• For high-risk processing, who reviews the residual risk and when do we consult regulators? A strong answer maps the assessment's residual risk to the internal executive escalation pathway and, where regulatory thresholds are met, produces the prior consultation packet sent to the supervisory authority, per the privacy impact and cross-border transfer procedure (its Step 5).
• On what legal mechanisms do our cross-border data transfers rely? A strong answer produces the completed transfer impact assessments and the executed transfer tools (such as standard contractual clauses or adequacy frameworks). The privacy impact and cross-border transfer procedure details the mechanism selection and supplementary-measures sequence for transferring data out of regulated jurisdictions (its Step 4).

A weak answer in this theme: privacy impact assessments conducted only after a system is fully built or deployed, treating privacy as a compliance checklist rather than a design requirement.

Theme: data subject rights. Can individuals control their data?

• How do we confirm individuals can exercise their rights to access, correct, or delete their personal data? A strong answer produces operational metrics as evidence that requests were fulfilled within the applicable statutory timeframe. The privacy and data governance policy sets the response requirements across jurisdictions (its section 4.8).
• For AI models trained on personal data, how do we govern the provenance and lawful basis of that training data? A strong answer draws from the dataset provenance metadata and lawful-basis determinations. The privacy and data governance policy requires AI models to be trained only on compliant datasets with documented provenance metadata, and directs lawful-basis determinations to the guidance it names (its section 4.7).

A weak answer in this theme: a manual, ad hoc process for fulfilling data subject requests with no evidence that statutory deadlines or identity-verification requirements are met.

Theme: breach response. Would we meet our regulatory notification deadlines?

• If a personal data breach occurs, how do we determine whether regulatory notification is required, and by when? A strong answer traces a recent incident through the initial assessment and the formal notification assessment. The data protection and privacy breach response procedure sets the jurisdictional notification triggers and targets (its sections 4 and 6).
• Have our third-party suppliers contractually committed to notifying us of breaches in time for us to meet our own regulatory deadlines? A strong answer points to the contractual notification window established with processors. The data protection and privacy breach response procedure operationalizes this requirement (its section 6.3).
• Following a material breach, how do we confirm the root cause is fixed? A strong answer produces the post-incident review (PIR) report with tracked corrective actions. The data protection and privacy breach response procedure makes the PIR mandatory for the highest severity classes within a set timeframe from closure (its section 8).

A weak answer in this theme: relying on a generic incident response plan that lacks specific jurisdictional privacy notification deadlines.

Each item below is an evidence class the governing body can call for from management, and each is evidence for a named control or outcome.

• The documented reporting line and any conflict-of-interest mitigation records, as evidence for the structural independence of the privacy function, per the privacy management programme charter.
• Written mandates for regional privacy representatives, as evidence for jurisdictional accountability, per the privacy management programme charter.
• Completed Privacy Impact Assessments (PIAs) and Transfer Impact Assessments (TIAs), as evidence for the privacy-by-design control and cross-border safeguard selection, per the privacy impact and cross-border transfer procedure.
• Internal residual-risk acceptance records and supervisory-authority consultation packets, as evidence for the high-risk processing escalation control, per the privacy impact and cross-border transfer procedure.
• Operational metrics on data subject request fulfillment, as evidence for the rights-management control, per the privacy and data governance policy.
• The current breach register and recent post-incident review (PIR) reports, as evidence for the organization's adherence to regulatory notification deadlines and remediation practices, per the data protection and privacy breach response procedure.
• Executed data processing agreements containing the supplier notification clause, as evidence for third-party breach notification controls, per the data protection and privacy breach response procedure.

• This page creates no compliance and imposes no requirement. The linked corpus documents govern; where this page differs from a corpus document, the corpus document prevails.
• These questions are advisory. They organize a line of questioning; the decision about what to ask, and what to accept as an answer, remains entirely with the reader's organization.
• This page carries composite claims. The pairing of each question with an evidence expectation, and the weak-answer characterizations, are synthesized across the listed corpus sources, and the adopting organization validates that reading against its own governance model, committee structure, and delegation of authority.
• Every threshold, cadence, severity level, role designation, statutory timeframe, and approval authority lives in the corpus documents this page links. This page routes to them and does not reproduce them; that routing is a contribution to the corpus's status as the single source for every value.
• Expected evidence describes what the corpus defines, not what any given organization has implemented. A gap between the two is itself an oversight finding, to be handled through the risk and exception routes the corpus provides rather than by softening the question.
• This page makes no claim about how likely any failure is, and none of its statements should be read as a probability or a frequency.