> Acme Inc — Formal Privacy Program Establishment

>

> Effective Date: 2026-03-19

>

> Generated by Codepliant Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

## 1. Mission Statement

The Privacy Program of Acme Inc exists to protect the personal data of all individuals whose information we collect, process, or store. Our mission is to embed privacy into every aspect of our operations, maintain compliance with applicable data protection regulations, and foster a culture of transparency and accountability.

### 1.1 Core Principles

1. Privacy by Design — Build privacy protections into products and processes from the outset
2. Data Minimisation — Collect only what is necessary for the stated purpose
3. Transparency — Clearly communicate data practices to all stakeholders
4. Accountability — Maintain demonstrable compliance with all applicable regulations
5. Security — Protect personal data with appropriate technical and organisational measures

## 2. Scope

This charter applies to:

- All Acme Inc employees, contractors, and temporary staff
- All business units and departments
- All systems and applications that process personal data
- All third-party vendors and sub-processors
- All data subjects whose information is processed

### 2.1 Data Processing Landscape

Based on automated code analysis, Acme Inc currently processes data through 8 detected service(s):

- Monitoring: @sentry/node
- Auth: @supabase/supabase-js
- Ai: openai
- Analytics: posthog
- Database: prisma
- Email: resend
- Payment: stripe, stripe-ios

### 2.2 Data Categories in Scope

- [object Object]
- [object Object]
- [object Object]
- [object Object]
- [object Object]
- [object Object]
- [object Object]
- [object Object]
- [object Object]

## 3. Regulatory Framework

The Privacy Program is designed to comply with the following regulations:

Regulation | Jurisdiction | Key Requirements
--- | --- | ---
GDPR | EU/EEA | Lawful basis, data subject rights, DPO, DPIA, breach notification
ePrivacy Directive | EU/EEA | Cookie consent, electronic communications
UK GDPR + DPA 2018 | United Kingdom | UK-specific data protection requirements
EU AI Act | EU/EEA | AI risk classification, transparency, human oversight
Industry standards | Global | SOC 2, ISO 27001, NIST CSF (as applicable)

## 4. Governance Structure

### 4.1 Privacy Governance Hierarchy

    ┌─────────────────────────────────┐
    │        Board of Directors        │  Ultimate accountability
    ├─────────────────────────────────┤
    │     Executive Leadership         │  Strategic oversight
    │     (CEO / COO / CTO)            │
    ├─────────────────────────────────┤
    │   Privacy Steering Committee     │  Cross-functional governance
    ├─────────────────────────────────┤
    │   Data Protection Officer (DPO)  │  Day-to-day program management
    ├─────────────────────────────────┤
    │   Privacy Champions (per team)   │  Departmental privacy advocates
    └─────────────────────────────────┘

### 4.2 Privacy Steering Committee

Aspect | Detail
--- | ---
Composition | DPO (Chair), CTO, Legal Counsel, Head of Engineering, Head of Product, CISO
Meeting cadence | Quarterly (monthly if active incidents or regulatory changes)
Quorum | DPO + 3 additional members
Reporting | Minutes distributed to all members; quarterly summary to Board
Decision authority | Approve DPIAs, vendor assessments, policy changes, breach responses

## 5. Key Roles & Responsibilities

### 5.1 Data Protection Officer (DPO)

- Name: Jane Mueller
- Email: dpo@acme-saas.com

Responsibilities:

- Monitor compliance with GDPR and other data protection laws
- Advise on Data Protection Impact Assessments (DPIAs)
- Act as the point of contact for supervisory authorities
- Manage data subject access requests (DSARs)
- Oversee privacy training programme
- Report to the Privacy Steering Committee

### 5.2 Engineering & Product

- Implement Privacy by Design in all new features
- Conduct privacy reviews during code review process
- Maintain data flow documentation
- Implement technical controls (encryption, access control, logging)
- Ensure AI systems comply with transparency and explainability requirements

### 5.3 Legal & Compliance

- Draft and review privacy policies and notices
- Negotiate DPAs with vendors and customers
- Monitor regulatory changes and assess impact
- Support incident response with legal guidance

### 5.4 All Staff

- Complete annual privacy awareness training
- Report suspected data breaches immediately
- Follow the data classification and handling policies
- Escalate privacy concerns to the DPO

## 6. Annual Objectives & Metrics

### 6.1 Objectives

# | Objective | Target | Owner
--- | --- | --- | ---
1 | Achieve 100% staff privacy training completion | 100% by Q2 | dpo@acme-saas.com
2 | Complete DPIA for all high-risk processing activities | All identified DPIAs complete | DPO + Engineering
3 | Review and update all vendor DPAs | Annual renewal cycle | Legal
4 | Reduce DSAR response time | < 15 business days average | DPO
5 | Conduct privacy-focused penetration test | 1 per year minimum | CISO
6 | Complete AI risk assessments for all AI-powered features | All AI features assessed | Engineering + DPO
7 | Zero unresolved critical privacy findings | 0 open critical items | Privacy Steering Committee

### 6.2 Key Performance Indicators (KPIs)

KPI | Measurement | Target | Frequency
--- | --- | --- | ---
Training completion rate | % of staff completing annual training | ≥ 95% | Quarterly
DSAR response time | Average days to fulfil DSAR | ≤ 15 days | Monthly
Breach notification time | Hours from detection to authority notification | ≤ 72 hours | Per incident
Vendor compliance rate | % of vendors with current DPAs | 100% | Quarterly
DPIA completion rate | % of high-risk activities with completed DPIA | 100% | Quarterly
Privacy by Design adoption | % of new features with privacy review | ≥ 90% | Monthly
Data minimisation score | Codepliant compliance score | ≥ 80/100 | Per release
Cookie consent rate | % of users making an active cookie choice | ≥ 70% | Monthly

## 7. Program Activities

### 7.1 Annual Calendar

Quarter | Activity | Responsible
--- | --- | ---
Q1 | Annual privacy risk assessment | DPO
Q1 | Update Record of Processing Activities | DPO + Engineering
Q1 | Vendor DPA renewal review | Legal
Q2 | Privacy training campaign launch | DPO + HR
Q2 | Data mapping refresh | Engineering
Q3 | Privacy impact assessment reviews | DPO + Product
Q3 | Penetration test (privacy-focused scope) | CISO
Q4 | Annual privacy program review | Privacy Steering Committee
Q4 | Regulatory landscape review | Legal
Q4 | Board privacy report | DPO
Ongoing | Incident response readiness drills | DPO + Engineering
Ongoing | DSAR handling and tracking | DPO

### 7.2 Continuous Activities

- Code scanning: Run Codepliant on every release to detect changes in data processing
- Vendor monitoring: Track sub-processor changes and assess new vendors
- Regulatory monitoring: Subscribe to supervisory authority updates
- Incident response: Maintain and test the breach response plan
- PCI compliance: Maintain PCI DSS compliance for payment processing

## 8. Budget & Resources

The Privacy Program requires dedicated budget for:

Category | Items | Estimated Annual Cost
--- | --- | ---
Personnel | DPO (full-time or fractional), Privacy Champions (% of time) | [To be determined]
Tools | Compliance scanning (Codepliant), consent management, DSAR automation | [To be determined]
Training | Annual privacy training, specialised DPO training | [To be determined]
Legal | External legal counsel, regulatory filings | [To be determined]
Audit | Annual privacy audit, penetration testing | [To be determined]
Insurance | Cyber liability / data breach insurance | [To be determined]

## 9. Incident Response Integration

The Privacy Program integrates with the Incident Response Plan:

1. Detection — Privacy incidents are reported through the same channels as security incidents
2. Assessment — DPO assesses whether a personal data breach has occurred
3. Notification — Authority notification within 72 hours (GDPR Art. 33); data subject notification without undue delay if high risk (GDPR Art. 34)
4. Remediation — Technical fixes, process improvements, updated DPIAs
5. Lessons learned — Post-incident review with Privacy Steering Committee

## 10. Charter Review & Approval

Aspect | Detail
--- | ---
Review frequency | Annually, or upon significant regulatory changes
Approval authority | Privacy Steering Committee + Executive Leadership
Charter owner | Jane Mueller (dpo@acme-saas.com)
Last reviewed | 2026-03-19
Next review due | 2027-03-19

## 11. Contact

For questions about the Privacy Program:

- DPO: Jane Mueller — dpo@acme-saas.com
- General Contact: legal@acme.com
- Website: https://acme-saas.com

This Privacy Program Charter was auto-generated by Codepliant based on code analysis. Customise the objectives, budget, and governance structure to match your organisation. Review with your DPO and executive leadership before adoption.