Everyone in our organisation must understand what privacy and data protection are. We must all understand the basics of what the law requires. We must all care about privacy and data protection. We must all know what we have to do in our day to day work to help maintain our organisation’s compliance with the law.

This is how we all do that:

A. Privacy Hub Owner

The Privacy Hub Owner (the project manager responsible for building and maintaining compliance on behalf of the leadership team):

must obtain the buy in of the leadership team to the importance of a culture of continuous privacy compliance;

must train the Privacy Champions on what a culture of continuous privacy compliance means and how to use The Hub;

must report regularly to the leadership team on the status of privacy compliance;

needs to make the leadership team and relevant members of staff aware of any privacy concerns; and

must be responsible for, contribute to and encourage a culture of continuous privacy compliance within our organisation.

B. Privacy Champions

The Privacy Champions (those people appointed by the Privacy Hub Owner to ensure compliance reaches all parts of our organisation):

meet regularly to ensure that the building and maintenance of compliance using our Route Map, in accordance with our organisation’s Privacy Promises, maintains momentum;

encourage members of their departments and teams to complete privacy training;

underline to staff the importance of reading and watching content distributed by the Privacy Champions;

ensure that all staff receive any specific training they need to carry out their roles in accordance with privacy law;

make sure that all members of their teams have read and understand all privacy related documentation; and

contribute to and encourage a culture of continuous privacy compliance within our organisation.

C. All Staff

All staff (including the Privacy Hub Owner and the Privacy Champions) shall:

attend all privacy training sessions to which they are invited;

promptly complete any online training they are sent;

read and understand the All Staff Privacy Pledge, the All Staff Tech Use and Confidentiality Policy and the Staff Privacy Notice;

understand what privacy compliance means and why they should care;

understand what they can do to help build and maintain the organisation’s privacy and data protection compliance; and

contribute to and encourage a culture of continuous privacy compliance within our organisation.