Why documentation alone is not enough
Many organisations have a register, a data deletion concept and policies. Nevertheless, data is not deleted, access requests take weeks, and when internal audit asks for evidence, the search begins. The gap lies between the document and the systems.
Privacy Operations closes this gap: the requirements from the documentation are implemented in the systems, and every implementation leaves behind proof.
The building blocks of Privacy Operations
| Building block | Key question | Result |
|---|---|---|
| Find | Where is personal data stored? | Findings per source |
| Record | Which systems, retention periods and responsible persons are there? | Register and retention schedule |
| Respond | What do we know about this person? | Access requests answered on time |
| Delete | What is due, what can go? | Deletion across all systems |
| Control AI | What is held in the AI data? | Classified AI systems, verified retention commitments |
| Share | Who receives what, and for what purpose? | Pseudonymised, traceable sharing |
| Prove | What has happened? | Logs and audit trail |
How it differs from related approaches
| Approach | Focus | Relationship to Privacy Operations |
|---|---|---|
| Documentation tools | Registers, questionnaires, impact assessments | Privacy Operations uses the documentation and implements it in the systems. |
| Data Loss Prevention (DLP) | Monitors data flows and prevents leakage | Privacy Operations does not monitor data traffic; data is deliberately shared via a protected route. |
| Data catalogue | Describes all data for analytics and governance | Privacy Operations focuses on personal data and the obligations relating to it. |
What makes a Privacy Operations Cockpit
A cockpit brings the building blocks together: findings flow into the register, retention periods go to deletion, erasure requests run through all systems, proof comes back. An overall picture shows where things are stuck – across all obligations instead of in many spreadsheets.
People are in control: approvals by authorised people (four-eyes for retention periods and erasure requests) and clear roles ensure that decisions remain traceable.