PDPL: vendors, breaches, policies and training

Interactive tutorial

Follow the course step by step in the interactive player.

Lessons

1. 1Find your way around Vendor risk and the questionnaire libraryThis lesson is for the Data Protection Officer. You will open Vendor risk, learn what its four tabs and five counters are for, and look through the six ready-made questionnaires in the library so that you know which one to send to which kind of supplier.6 min
2. 2Make your own questionnaire from a library copyThis lesson is for the Data Protection Officer. You will copy a library questionnaire, rename it, add a question of your own with a weight and a critical control, and publish it so that it can be sent to vendors.7 min
3. 3Add a vendor to the risk register and read its profileThis lesson is for the Data Protection Officer. You will add a supplier that handles personal data for you to the vendor risk register, filling in every field of the form, and then open the vendor's profile to see how its inherent risk is worked out.7 min
4. 4Send a vendor a due-diligence questionnaire by secure linkThis lesson is for the Data Protection Officer. You will send a questionnaire to a vendor through a secure link, copy the link instead of e-mailing it, and learn how to follow the questionnaire and manage its link while the vendor is answering.7 min
5. 5What the vendor sees: answering the questionnaireThis lesson shows the questionnaire from the vendor's side, so that you can guide a supplier through it. The vendor's contact opens the secure link without signing in, answers each section, uploads a contract and a photographed certificate as evidence, and submits the answers.8 min
6. 6Review a vendor's answers, check the evidence and challenge a weak answerThis lesson is for the Data Protection Officer. You will open a questionnaire that a vendor has submitted, read how the risk score and tier were worked out, download the answers and the evidence, accept an answer, and send one weak answer back to the vendor with a comment.8 min
7. 7What the vendor sees: changing an answer the reviewer challengedThis lesson shows the vendor's side again. After you return a questionnaire, the vendor's contact opens the same kind of secure link, finds your comment beside the question you challenged, changes the answer and submits again.3 min
8. 8Accept the revised answer, raise a finding and request approvalThis lesson is for the Data Protection Officer who prepares the review. You will accept the answer the vendor revised, recalculate the score, raise a finding with an owner and a due date for a gap that remains, and ask a second person to approve the vendor's risk tier.6 min
9. 9Approve a vendor's risk tier as the second personThis lesson is for the second Data Protection Officer, who approves. You will find the request in your Approvals inbox, open the assessment, check the score and the findings your colleague raised, approve the vendor's risk tier, and see when the vendor must be assessed again.6 min
10. 10Work with the vendor register: overrides, search, filters, download and archiveThis lesson is for the Data Protection Officer. You will add a second vendor whose risk factors you set by hand, then search and filter the register, download it, and archive and restore a vendor.7 min
11. 11Follow up findings and tune the vendor risk settingsThis lesson is for the Data Protection Officer. You will update a finding as the vendor works on it, learn what is needed to close one, download the findings list, and go through the settings that decide tiers, review dates, risk weights and reminders.6 min
12. 12Log a personal data breach, field by fieldThis lesson is for the Data Protection Officer. You will record a personal data breach as soon as you learn of it, filling in every field of the form: what happened, when it was detected, how severe it is, how many people and which data are affected, what has been done, and what the report to the regulator must say.8 min
13. 13Follow the deadline clock, update a breach and void an entry made in errorThis lesson is for the Data Protection Officer. You will read the deadline clock on a breach, open its full detail, update its status and findings as the investigation moves on, void a breach that was logged by mistake, and download the breach log.7 min
14. 14Draft the notification to the regulator and send it for approvalThis lesson is for the Data Protection Officer who prepares the notices. You will open the breach's notifications page, read who the regulator is, draft the notification from the breach record, complete a section, download it as a PDF in English and Arabic and as a data file, and submit it for approval.7 min
15. 15Draft the notice to the people affected, in English and ArabicThis lesson is for the Data Protection Officer who prepares the notices. You will draft the plain-language notice to the people affected by the breach, translate the Arabic text, see how ComplianceOS checks the Arabic for passages left in English, add the recipients, and submit the notice for approval.8 min
16. 16Approve the breach notices and confirm the Arabic textThis lesson is for the second Data Protection Officer, who approves. You will find the two breach notices in your Approvals inbox, read and approve the notification to the regulator, and approve the notice to the people affected, ticking the logged confirmation that its Arabic text is complete.6 min
17. 17Deliver the approved notices and record them as sentThis lesson is for the Data Protection Officer. Once both notices are approved, you will download the final documents, deliver them outside ComplianceOS, record when and how each was sent, and see the breach, its deadline clock and the Reported to regulator tile update.6 min
18. 18Draft a privacy policy from a starter templateThis lesson is for the Data Protection Officer who writes policies. You will open Privacy policies and training, start a policy from a starter template, give it your own title, replace the placeholder for the data protection contact, adapt the English and Arabic text, set its owner and review cycle, see why you cannot record the legal review of your own draft, and submit it for approval.8 min
19. 19Record the legal review, then approve and publish the policyThis lesson is for the second Data Protection Officer, who approves policies. You will find the policy in your Approvals inbox, see that a policy started from a template cannot be approved until its legal review is recorded, record that review, approve the version so that it is published, and check the published text and the library.6 min
20. 20Change a published policy, compare versions, retire a policy and filter the libraryThis lesson is for the Data Protection Officer who looks after the policy library. You will start a new version of a published policy, compare two versions line by line, write a short policy from a blank page, retire a policy that is no longer needed, and use the library filter to find policies by state.8 min
21. 21Publish your privacy notice on a public pageThis lesson is for the Data Protection Officer. You will choose which published policy is your public privacy notice, switch its public page on, copy the link for your website, and look at the page as a member of the public sees it, in English and Arabic.4 min
22. 22Ask staff to read and acknowledge a policyThis lesson is for the Data Protection Officer. You will create an attestation campaign, which asks a group of people to read a published policy and confirm that they have understood it. You will choose the audience by org unit, set the due date, the reminders and the escalation, and launch the campaign.7 min
23. 23Build a training module with a lesson and a quizThis lesson is for the Data Protection Officer. You will add the ready-made starter modules, then write your own short training module: a summary, the time it takes, the pass mark, the lesson text and two quiz questions. You will see that a module cannot be activated without a question, and then activate it.8 min
24. 24Assign privacy training by role and by nameThis lesson is for the Data Protection Officer. You will create a training campaign that assigns a training module to everyone who holds a role, add one more person by name, set the due date and the yearly refresher, launch it, and correct a setting on the live campaign.6 min
25. 25For every employee: acknowledge a policy and complete your trainingThis lesson is for every member of staff. You will open My privacy tasks, read a policy and confirm that you have understood it, take a short training with a quiz, see what happens when an answer is wrong, pass on the second attempt, and download your certificate.6 min
26. 26Track who has acknowledged and trained, and keep the records as evidenceThis lesson is for the Data Protection Officer. Once staff have started on their tasks, you will read the Overview with its governance score, completion by org unit and by campaign, and the overdue list. You will then open a campaign to filter and search the people, download the records and a certificate, and save the completion records to the evidence vault for auditors.7 min
27. 27For administrators: privacy policies and training across the groupThis lesson is for an organisation administrator or anyone who oversees more than one entity. You will open the group overview of privacy policies and training, compare the entities you can see, open the detail behind one entity's figures, filter the list, and drill down to that entity's completion by org unit.5 min
28. 28How this connects: put the vendor's agreement into ContractsThis lesson is for legal counsel, and for the privacy team who work with them. The data processing agreement that the courier attached to its questionnaire also belongs in the Contracts module. You will open Contracts and upload the signed agreement, so that it can be read, scored and, in the last lesson of this course, linked to the vendor you assessed.3 min
29. 29How this connects: a breach becomes a risk in the risk registerThis lesson is for the compliance officer who keeps the risk register, and for the privacy team who feed it. It shows that a logged breach appears in the risk register as a data privacy risk, scored by the severity chosen when the breach was logged, next to risks raised by other modules such as Contracts.4 min
30. 30How this connects: privacy records as evidence for an auditThis lesson is for the auditor, and for the privacy team who prepare for one. It shows that the work done in this course leaves sealed evidence behind: the files a vendor uploaded, the record that a breach was logged, and the training completion records saved from a campaign all appear in the Evidence Vault, where an auditor can read and download them but not change them.4 min
31. 31How this connects: the vendor you assessed is the supplier on its contractThis lesson is for legal counsel, and for the privacy team who work with them. It shows that the vendor assessed in Vendor risk and the counterparty on a contract are one and the same record. You will open the data processing agreement uploaded in lesson twenty-eight, read what was extracted from it, and link its counterparty to the vendor that the Data Protection Officer added.4 min

How this connects to the rest of ComplianceOS

• Contracts

  The vendor you assess is the same supplier record that a contract links to as its counterparty. Vendors are added once, in the vendor directory shared with Tax, and searched for from the contract.

• Risk register

  A breach that is not closed appears in the Risk Register after a sync, as a data privacy risk scored by its severity: High gives four times four. The measures recorded on the breach become the risk's first treatment plan.

• Evidence Vault and Audit Hub

  Files a vendor attaches to a questionnaire and the record of each logged breach are sealed in the Evidence Vault automatically. Campaign completion records are added with Save to evidence vault, ready for an auditor.

• Approvals

  Vendor risk tiers, breach notices and policy versions each raise a request in the Approvals inbox, and the person who prepared the record cannot decide it.

• Workforce and access

  Policy acknowledgement and training campaigns are addressed by org unit, role or named person, and overdue items escalate to the line manager recorded in Workforce.