> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Organization: Acme Inc

DPO: Jane Mueller (dpo@acme-saas.com)

Last updated: 2026-03-19

This handbook outlines the responsibilities, reporting structure, and operational procedures for the Data Protection Officer (DPO) at Acme Inc, in accordance with GDPR Articles 37-39.

## 1. Role and Appointment (GDPR Art. 37)

### 1.1 When a DPO Is Required

A DPO must be designated when:

- The processing is carried out by a public authority or body
- Core activities require regular and systematic monitoring of data subjects at scale
- Core activities involve large-scale processing of special categories of data

Assessment for Acme Inc: A DPO is likely mandatory based on:

- 8 third-party data processors detected (systematic processing at scale)
- AI services detected (automated decision-making / profiling)

### 1.2 Appointment Requirements

The DPO must:

- Be appointed based on professional qualities, in particular expert knowledge of data protection law and practices
- Be either a staff member or engaged under a service contract
- Be provided with resources necessary to carry out their tasks
- Be given access to personal data and processing operations
- Not be dismissed or penalized for performing their DPO tasks

## 2. Position and Independence (GDPR Art. 38)

### 2.1 Reporting Structure

    ┌─────────────────────┐
    │   Board / CEO       │
    │   (Direct report)   │
    └─────────┬───────────┘
              │
              ▼
    ┌─────────────────────┐
    │   DPO               │
    │   Jane Mueller      │
    └─────────┬───────────┘
              │
        ┌─────┼─────┐
        ▼     ▼     ▼
      Legal  IT  Business
      Team   Team  Units

### 2.2 Independence Requirements

- The DPO reports directly to the highest level of management
- The DPO shall not receive instructions regarding the exercise of their tasks
- The DPO shall not be dismissed or penalized for performing their duties
- The DPO may fulfill other tasks, provided they do not result in a conflict of interest

### 2.3 Conflict of Interest

The DPO must not simultaneously hold any of these roles:

Role | Why It Conflicts
--- | ---
CEO / Managing Director | Determines purposes of processing
CFO | Determines financial data processing
Head of Marketing | Decides on marketing data usage
Head of HR | Decides on employee data processing
Head of IT | Implements technical processing decisions

## 3. Tasks and Responsibilities (GDPR Art. 39)

### 3.1 Core Tasks

Task | Description | Frequency
--- | --- | ---
Inform and advise | Advise the organization and employees on data protection obligations | Ongoing
Monitor compliance | Oversee compliance with GDPR and internal policies | Continuous
Training | Organize staff awareness and training programs | Quarterly
DPIA oversight | Advise on Data Protection Impact Assessments | Per project
Supervisory authority | Act as contact point for the supervisory authority | As needed
Data subject requests | Oversee DSAR handling process | As received
Breach management | Coordinate breach notification procedures | As needed
Records maintenance | Maintain records of processing activities (Art. 30) | Quarterly review

### 3.2 Operational Checklist

#### Daily

- Review incoming DSAR requests
- Monitor security incident alerts for potential data breaches
- Check DPO email inbox for data subject inquiries

#### Weekly

- Review new vendor/service integrations for data protection implications
- Check DSAR response deadlines (30-day timer)
- Review any pending consent changes or policy updates

#### Monthly

- Update Record of Processing Activities if changes occurred
- Review sub-processor list for additions or changes
- Assess any new processing activities for DPIA necessity
- Report compliance status to management

#### Quarterly

- Conduct staff data protection awareness training
- Review and update privacy policies and notices
- Audit consent management mechanisms
- Review data retention and deletion practices
- Update risk register and mitigation measures

#### Annually

- Comprehensive compliance audit
- Review and update DPIAs for existing high-risk processing
- Update transfer impact assessments
- Submit annual report to board/management
- Review and renew DPA agreements with processors

## 4. Escalation Procedures

### 4.1 Escalation Matrix

Situation | Escalation Level | Timeline | Action
--- | --- | --- | ---
Routine DSAR | DPO handles directly | 30 days max | Process and respond
Complex DSAR (multiple systems) | DPO + IT Lead | 30 days max | Coordinate data retrieval
Minor data incident (no breach) | DPO + IT Security | 24 hours assessment | Investigate and document
Confirmed data breach | DPO + CEO + Legal | 72 hours to authority | Notify authority, assess user notification
Regulatory inquiry | DPO + Legal Counsel | Immediate | Cooperate and respond
DPO advice rejected by management | DPO documents in writing | Record immediately | Formal written objection

### 4.2 Data Breach Escalation

    Incident Detected
           │
           ▼
    ┌──────────────────┐    No    ┌──────────────┐
    │ Personal data    │────────▶│ IT Security  │
    │ involved?        │         │ handles      │
    └────────┬─────────┘         └──────────────┘
        Yes  │
             ▼
    ┌──────────────────┐
    │ DPO notified     │
    │ (within 1 hour)  │
    └────────┬─────────┘
             │
             ▼
    ┌──────────────────┐    Low   ┌──────────────┐
    │ Risk to rights   │────────▶│ Document     │
    │ and freedoms?    │         │ internally   │
    └────────┬─────────┘         └──────────────┘
       High  │
             ▼
    ┌──────────────────┐
    │ Notify authority │
    │ within 72 hours  │
    └────────┬─────────┘
             │
             ▼
    ┌──────────────────┐
    │ Notify affected  │
    │ individuals      │
    └──────────────────┘

## 5. DSAR Handling Process

### 5.1 Response Timeline

Step | Deadline | Responsible
--- | --- | ---
Request received | Day 0 | DPO
Identity verification | Day 1-3 | DPO
Scope assessment | Day 3-5 | DPO
Data collection from systems | Day 5-20 | DPO + IT
Review and redaction | Day 20-25 | DPO + Legal
Response to data subject | Day 25-30 (max) | DPO

### 5.2 Systems to Query (8 detected)

- @sentry/node (monitoring): error data, stack traces, user context
- @supabase/supabase-js (auth): email, password hash, session data
- openai (ai): user prompts, conversation history, generated content
- posthog (analytics): user behavior, session recordings, feature flag usage
- prisma (database): user data as defined in schema
- resend (email): email addresses, email content
- stripe (payment): payment information, billing address, email
- stripe-ios (payment): payment information, billing address, email

## 6. AI-Specific DPO Responsibilities

AI services have been detected in this project. The DPO has additional responsibilities under the EU AI Act and GDPR:

- Automated decision-making (Art. 22): Ensure data subjects are informed and can request human review
- DPIA for AI: Conduct or advise on DPIAs for AI processing that is likely high-risk
- AI transparency: Verify AI disclosure documents are accurate and up-to-date
- Training data governance: Oversee data used for AI training, ensure lawful basis
- Bias monitoring: Review AI outputs for discriminatory patterns or bias
- Vendor AI agreements: Review AI provider DPAs for adequate safeguards

## 7. Payment Data Responsibilities

Payment services have been detected. Additional DPO responsibilities include:

- PCI DSS coordination: Ensure payment data handling meets PCI DSS requirements
- Financial data retention: Verify retention periods comply with tax and accounting laws (typically 7 years)
- Payment processor oversight: Review DPAs with payment processors (Stripe, PayPal, etc.)
- Cardholder data scope: Minimize the scope of cardholder data your systems touch

## 8. Key Contacts and Resources

### Internal Contacts

Role | Name | Email
--- | --- | ---
Data Protection Officer | Jane Mueller | dpo@acme-saas.com
General Contact | [Name] | legal@acme.com
Legal Counsel | [Name] | [email]
IT Security Lead | [Name] | [email]
HR Lead | [Name] | [email]

### Supervisory Authorities

Authority | Jurisdiction | Website
--- | --- | ---
[Your lead authority] | [Country] | [URL]
ICO | United Kingdom | https://ico.org.uk
CNIL | France | https://www.cnil.fr
BfDI | Germany | https://www.bfdi.bund.de
DPC | Ireland | https://www.dataprotection.ie

### Key Regulations

- GDPR — General Data Protection Regulation (EU) 2016/679
- ePrivacy Directive — Directive 2002/58/EC (cookies, electronic communications)
- EU AI Act — Regulation (EU) 2024/1689
- PCI DSS — Payment Card Industry Data Security Standard

## Related Documents

- Privacy Policy (`PRIVACY_POLICY.md`)
- Record of Processing Activities (`RECORDOFPROCESSING_ACTIVITIES.md`)
- DSAR Handling Guide (`DSARHANDLINGGUIDE.md`)
- Incident Response Plan (`INCIDENTRESPONSEPLAN.md`)
- Data Protection Policy (`DATAPROTECTIONPOLICY.md`)
- Annual Review Checklist (`ANNUALREVIEWCHECKLIST.md`)

This DPO Handbook was generated by Codepliant based on an automated scan of the nextjs-saas-example codebase. It should be reviewed and customized by your legal team and appointed DPO before adoption.