Workflow Gdpr Implementation Pack

GDPR / Data Protection Implementation Pack

Purpose

This workflow implements a data protection compliance program under GDPR (EU) and/or equivalent MENA regimes (UAE Federal Decree-Law 45/2021 on Personal Data Protection; Saudi Arabia's Personal Data Protection Law). The program is structured in twelve phases, spanning a typical 90–180 days for a medium-size organization.

Inputs

Parallel Regime Map

Phase 1 — Data Mapping (Weeks 1–3)

Objective: Know what personal data you hold, where it is, and what you do with it.

Activities:

1. Identify all systems and databases that contain personal data (CRM, HR, marketing platform, cloud storage, analytics, support ticketing, etc.)
2. For each system: identify — categories of personal data; categories of data subjects; purposes of processing; legal basis; retention period; who has access; whether data is shared with third parties; whether data is transferred outside the home country/EEA/UAE
3. Conduct department interviews (HR, marketing, IT, finance, legal) to catch non-obvious processing
4. Document in a Data Inventory / Record of Processing Activities (RoPA) — required under GDPR Art. 30; good practice under MENA regimes

Output: Data inventory spreadsheet / RoPA with at minimum: processing activity name, controller/processor, categories of data, data subjects, purposes, legal basis, transfers, retention, security measures.

Phase 2 — Lawful Basis Assignment (Weeks 2–4)

Objective: Assign a valid legal basis to each processing activity.

Available bases under GDPR (compare with MENA regimes):

MENA critical point: Legitimate interests (GDPR Art. 6(1)(f)) is the most flexible basis under GDPR for commercial processing. It is not available under UAE PDPL. UAE-operating organizations relying on legitimate interests for GDPR purposes must identify a different basis (typically consent or contract) for UAE PDPL compliance.

Phase 3 — Privacy Notice Rewrite (Weeks 3–5)

Objective: Publish a GDPR/PDPL-compliant privacy notice.

See [[draft-privacy-policy]] for the template. Key required elements under GDPR:

• Identity and contact details of the controller (and DPO if appointed)
• Purposes and legal bases for each category of processing
• Legitimate interests where relied upon (LIA summary)
• Categories of recipients
• International transfers and safeguards
• Retention periods (or criteria for determining them)
• Data subject rights and how to exercise them
• Right to withdraw consent
• Right to lodge a complaint with the supervisory authority

MENA additional requirements:

• UAE PDPL: notice in Arabic (or Arabic alongside English) where data subjects are Arabic speakers
• KSA PDPL: Arabic-language notice; specific disclosures about cross-border transfer consents

Phase 4 — Consent Mechanisms (Weeks 4–6)

Objective: Implement granular, revocable consent infrastructure.

GDPR-compliant consent:

• Cookies: PECR (UK) / ePrivacy Directive (EU): consent required for non-essential cookies; cookie banner must allow genuine choice; no pre-ticked boxes; categories must be specific
• Marketing communications: opt-in required for email/SMS marketing; unsubscribe mechanism on every communication
• Optional features: if a product feature processes personal data beyond what is necessary for the core service, it should be consent-based and optional

Technical implementation: a Consent Management Platform (CMP) such as OneTrust, Cookiebot, Usercentrics, or TrustArc should be implemented. The CMP must:

• Record consent (timestamp, mechanism, version of notice shown)
• Allow withdrawal as easily as giving consent
• Distinguish between cookie categories (strictly necessary, functional, analytics, advertising)

Phase 5 — Data Subject Rights (DSR) Process (Weeks 5–8)

Objective: Ability to respond to access, rectification, erasure, and other requests within legal timelines.

Process components:

1. Intake channel: email (dpo@company.com), in-app form, or postal address
2. Identity verification: before actioning a request, verify the requester's identity (proportionate to sensitivity of data)
3. Response template: for each right, a standardized response template
4. Tracking: log all requests, date received, date responded, outcome
5. Escalation: when is a request refused? (exemptions under GDPR Art. 12; document the basis)

Phase 6 — Breach Response Playbook (Weeks 6–8)

Objective: 72-hour notification readiness.

GDPR breach response:

• Detection → Assessment → Notify must complete within 72 hours (GDPR Art. 33) for notifiable breaches (likely risk to data subjects' rights)
• High-risk breaches additionally require notification to affected data subjects (Art. 34) without undue delay

Playbook elements:

1. Detection procedures: how will breaches be identified? (monitoring, employee reporting, third-party notification)
2. Incident severity classification: minor (no notification needed) / significant (supervisory authority notification) / high-risk (also notify individuals)
3. Notification template: GDPR Art. 33(3) requires: nature of breach; categories and approximate number of data subjects; categories and approximate number of records; contact details of DPO; likely consequences; measures taken or proposed
4. Communication protocols: who is the internal breach response team? who approves notification to authorities?
5. Documentation: all breaches must be documented regardless of whether notification is required (Art. 33(5))

MENA notification timelines:

• UAE PDPL: notify TDRA (Telecommunications and Digital Government Regulatory Authority) "without delay"
• KSA PDPL: notify SDAIA within 72 hours for breaches that harm data subjects

Phase 7 — Vendor Data Processing Agreements (Weeks 7–10)

Objective: GDPR-compliant DPAs with all processors.

See [[draft-dpa-gdpr]] for template. Every vendor (processor) that processes personal data on your behalf must have a DPA covering:

• Subject matter, nature, purpose, and duration of processing
• Types of personal data and categories of data subjects
• Processor's obligations: process only on documented instructions; confidentiality; security; sub-processor management; data subject rights assistance; deletion/return on termination; audit rights
• Standard Contractual Clauses (SCCs) for international transfers where applicable

Vendor tier prioritization:

• Tier 1 (high-risk processors): CRM, HR platform, marketing automation, cloud infrastructure, analytics — DPA required immediately
• Tier 2 (standard processors): email service providers, support tools, productivity platforms — DPA required; standard template acceptable
• Tier 3 (low-risk/transient): couriers, professional advisors handling limited data — DPA or appropriate contractual provisions required

Phase 8 — International Transfers (Weeks 8–12)

Objective: Legal mechanism in place for all personal data transfers outside the EEA (for GDPR) and outside the UAE/KSA (for MENA regimes).

MENA applicability: UAE PDPL restricts transfers of personal data outside the UAE to countries with an "adequate level of protection" or under specific contractual safeguards. KSA PDPL similarly restricts cross-border transfers. Organizations processing data of UAE or KSA data subjects must review all data flows out of these countries.

Phase 9 — Records of Processing (Art. 30) (Ongoing from Phase 1)

The RoPA (Record of Processing Activities) initiated in Phase 1 must be:

• Maintained and kept current
• Available to supervisory authorities on request
• In writing (electronic format is fine)

Organizations with <250 employees are partially exempt from the GDPR Art. 30 obligation (certain conditions apply); however, maintaining a RoPA is good practice regardless of size, and MENA PDPL regimes do not carry this exemption.

Phase 10 — DPIA Process (Weeks 8–12)

Objective: Data Protection Impact Assessment capability for high-risk processing.

GDPR Art. 35 requires a DPIA before commencing processing that is "likely to result in a high risk" to individuals, including:

• Systematic profiling
• Large-scale processing of special categories (health, biometrics, criminal records)
• Systematic monitoring of publicly accessible areas
• New technologies

DPIA template elements:

1. Description of the processing and its purposes
2. Assessment of necessity and proportionality
3. Risks to data subjects
4. Measures to address those risks
5. DPO consultation (if appointed)

Phase 11 — Training (Weeks 10–16)

Objective: All staff with access to personal data understand their obligations.

Training program:

• All staff: awareness training (what is personal data, why it matters, how to handle data subject requests, how to report a breach) — 1-hour annual module
• Data owners / system administrators: deeper training on their specific systems and obligations
• Legal/compliance team: GDPR/PDPL advanced training; DPO qualification if applicable
• Training records: document completion; required for demonstrating accountability (GDPR Art. 5(2))

Phase 12 — Governance (Weeks 12–20)

Objective: Sustainable data protection governance structure.

Elements:

• DPO appointment: mandatory for public authorities; for private sector when large-scale systematic monitoring or large-scale special categories processing occurs; recommended for any significant data processor
• Privacy committee: cross-functional (legal, IT, HR, marketing, product); meets quarterly
• Policy framework: data protection policy; data retention policy; breach response policy; acceptable use policy
• Compliance dashboard: tracks ongoing obligations (DSR response times, breach record, DPA status, training completion)
• Annual review: update the RoPA, re-assess DPIAs for changed processes, renew vendor DPAs

Timeline Summary

Total: 90 days minimum for essential compliance (Phases 1–8); 180 days for full program including governance and training.

Related Skills

• [[draft-privacy-policy]]
• [[draft-dpa-gdpr]]
• [[review-gdpr-readiness]]
• [[workflow-hire-employee-pack]]
• [[workflow-full-due-diligence-pack]]