Front-line staff

Written for you, in the second person, because it is about what you should do.

Who you are. Somebody who handles data, operates a system, or answers questions about one, and who is not in a compliance function. Section 38.16 records that you generate most of the evidence and that almost nothing written about this subject is addressed to you.

How it is organised. By situation, not by law. Sections 65.4 to 65.11 are the situations the document actually treats, and you only need the ones you are in.

What it will not do. Explain the statutes. You do not need them. Section 35.4 records the principle this handbook is built on: train on subject matter, not on legal categories. Nobody expects you to know which right somebody is exercising.

One thing to read even if you read nothing else. Section 65.2.

And one thing this handbook does that the rest of the document does not. Section 65.15 records what your organisation owes you. Every other treatment of this lens tells you what to do; none says what you are entitled to in order to do it.

Section 38.16 puts it in four words: you are the evidence.

What that means. The record of what you were trained on, what you escalated, what you recorded and when is what your organisation produces when somebody asks whether it was in control. Not the policy. Not the certificate. What you actually did, written down at the time.

Which produces the only rule you need if you remember nothing else. Write down what actually happened, when it happened, and do not improve it later.

Why the last part matters more than it sounds. Section 38.16 records it and section 36.16 repeats it: a record that was tidied is worth less than no record at all. A gap in a record is a finding. A back-dated entry is a different and much worse problem, and it converts an organisational failure into a personal one.

The corollary. If you are ever asked to change a record after the fact, that is the moment to escalate, per section 65.13.

Four things, in any organisation, whatever your role.

Ask why data is being collected, and expect an answer. Section 38.16.

Ask who the data protection officer is. Section 38.16: their details are published and you are entitled to contact them. You do not need permission and you do not need to go through your manager — section 38.16 records that this route exists precisely for the case where your manager is the problem.

Say “I do not know.” Section 38.16 records it as a correct and useful answer on an assessment questionnaire. A guessed answer becomes a documented fact the organisation relies on.

And ask what the route is for anything you are unsure about. Section 36.16 records this for equipment disposal and it generalises. Section 38.11 records that the single most valuable thing you can know is who to ask.

Section 30.28 records this as the stage where front-line decisions are most frequent.

What you may do. Collect what your process asks for, from the person it concerns, having given them the notice your organisation provides. Record what you collected and why, in the system provided for it.

What you must not do, and section 30.28 records that each happens daily.

Do not add a field to a form, a spreadsheet or a script because it would be useful. Section 30.4: useful is not necessary.

Do not collect something because you might need it later. Section 30.24 records that the hardest question is not which basis but whether to collect at all.

Do not write things into a free-text field that you would not put in a formal record. Section 35.8 records that opinions about a person are within scope of an access request. They will read it.

And do not re-use data you already hold for a new purpose because it is to hand. Section 55.17 records the consequence where the new purpose is training a model: an acquisition error cannot be corrected out of a trained model.

What triggers escalation. A form asking for more than the process needs. A request to collect something not on the form. Anyone asking you to record a special category — health, biometrics, beliefs — outside a process designed for it.

Section 19.29 records this lens for the person who actually moves the data.

What you may do. Send data to a country on your organisation’s approved list, where there is one and the recipient is within the approval. Send it to a recipient already under an approved contract, for the purposes that contract covers. Use the systems your organisation approved for the purpose.

What you must not do. Section 19.29: do not email a spreadsheet of personal data to a colleague or a vendor in another country because it is quicker. Do not move data to a new recipient or a new country because the approved route is slow.

The one that surprises people. Remote access is a transfer. Section 62.10 records it as the category most often missing from a transfer register. Giving a colleague in another country a login is moving the data, even though nothing was sent.

What triggers escalation. A new recipient, a new country, or a new purpose for an existing recipient. Anyone asking you to grant access to someone outside your organisation’s approved list.

Section 36.16 records this lens for the person who physically handles things.

What you may do. Put media into secure destruction containers. Return devices through the defined route. Log what you handed over and get a receipt.

What you must not do, per section 36.16. Do not take decommissioned equipment home, even where it is being scrapped and even where you are told it is fine. Do not reformat and reissue a device without the sanitisation step. Do not put media in general waste or recycling. Do not leave media awaiting collection somewhere unlocked. Do not put paper in a normal bin because the secure bin is full — a full secure bin is a fault to report. And do not assume a device is empty because it looks empty, per section 36.2.

What triggers escalation. A device that will not wipe or will not power on, which section 36.5 records needs physical destruction rather than sanitisation. A count that does not match, in either direction. A collection that has not happened. Finding storage in something you did not expect to contain any — a printer, a camera, a scanner, a piece of test equipment. And discovering a system nobody uses that still holds data, which section 36.11 records is where destruction actually fails.

Section 43.22 records this lens.

What you may do. Use the tool as configured, within the process you were trained on. Tell a person that a system was involved in a decision — that is not confidential. Give the adverse action notice where one is required, per section 8.5. Escalate a result that looks wrong.

What you must not do. Collect a fingerprint, faceprint or voiceprint without the written consent required, per section 9.9 — which section 43.22 records as the single highest-liability act in this lens, because the exposure is damages fixed by statute per person. Consent comes before collection, and the sequence is the whole obligation. Skip an adverse action notice because the reason seems obvious. Tell someone no human was involved when one was, or that a human decided when the system did. Use a tool on a role or population it was not configured for. Alter a record after a complaint.

What triggers escalation. A pattern in outcomes that tracks a protected characteristic — you may be the first to see it. A question the script does not cover, which is often the notice that a legal right is being exercised. A tool used in a jurisdiction where you know the rules differ.

Section 40.40 records this lens, and it is the role with the most authority and the least support.

What you may do, and this is the point of the role. Disregard, override or reverse the system’s output. Decide not to use it in a particular case. Stop it.

And section 40.40 records the thing nobody tells overseers. You do not need to justify an override to the standard you would need to justify departing from a colleague’s advice. The system is required to be built so you can override it, which means overriding is an intended use and not an exception.

What you must not do. Approve output you have not actually considered. Use the system outside the intended purpose in the instructions for use, per section 40.20, which is the boundary of what the provider assessed. Feed it input you know is out of specification. Treat a high confidence score as a reason not to look.

What triggers escalation. Output wrong in a way you cannot explain. A pattern that has shifted, which section 55.10 records you are the first to see and for which section 56.2 records most organisations have no route to engineering. And being asked to process at a rate that does not allow real consideration of each case, which section 55.13 records converts oversight into rubber-stamping.

What you can reasonably ask for, if you were given a system rather than consulted about one — which is the ordinary case.

The instructions for use. Section 40.20 requires them to state the system’s capabilities, its limitations of performance, the circumstances that may lead to risk, and the population it was validated on. They exist, your organisation should hold them, and they are the document that tells you what the system is safe for. Section 62.6 records that a deployer should obtain them at procurement.

The declared accuracy and what population it was measured on. Section 56.8 records that most teams have the number and have not stated the population. If your caseload is not that population, that is worth knowing and worth escalating.

And whether anyone is monitoring for drift. Section 55.10 records that a declared accuracy on a model that keeps changing is a statement about a moment.

If none of this is available. Say so in writing, once, per section 65.15. An overseer who cannot obtain the system’s stated limitations is being asked to exercise judgement without the basis for it, and section 55.14 records that seeing the basis rather than the conclusion is what makes oversight real.

The number that matters. Section 55.13: the override rate is the only measure of whether your role works. If you have never overridden anything, that is information.

Sections 20.17, 26.15 and 27.15 record this lens for people in procurement, sales or compliance.

The first question, and section 26.15 records that it disposes of most of them. Is this an approved certification, or something else? An approved one names the approving authority, names an accredited body, and names the processing operations covered. A seal, a platform badge or a consultancy certificate does none of those.

The second question. Does the scope cover the thing you care about? Section 20.17 records scope as the decision with most consequence and least visibility, and section 64.5 that the client negotiates it.

For an AI compliance claim, per section 27.15. Is the system high risk at all — if not, the claim means little. Is there a CE mark, and does it carry a notified body number? Section 27.8. If there is no number the provider assessed itself, and section 27.4 records that this is normal rather than suspicious.

What you must not do. Section 20.17: do not tell a customer or a regulator that your organisation is certified without checking what the certificate covers. Do not rely on a supplier’s certificate for a question it does not address. And do not describe a certificate as compliance — section 38.14 records that adherence is evidence, not a defence.

Section 53.21 records this lens, and it reaches you more directly than any other part of the international layer.

What you may do. Read the actual standard rather than a vendor’s summary. Standards define their terms and the definitions govern — a word in a standard frequently does not mean what it means in ordinary use. Ask which version and year you are assessed against, per section 22.9. Ask what the scope statement covers, per section 22.26.

What you must not do. Treat a certificate as a legal defence. Map a control to a requirement it does not meet because the audit is next week. Assume that because a standard is silent, nothing is required — the standard is not the law.

What triggers escalation. A conflict between what the standard requires and what the law requires, where the law wins and somebody senior needs to record the decision. A scope that does not cover the processing anyone cares about. An auditor accepting evidence you know does not demonstrate what it is offered as demonstrating.

The sentence section 53.21 gives you. A standard tells you what good practice looks like; it does not tell you what the law requires, and it was written by people who do not know your organisation.

Section 35.4 records that this is where most rights requests are lost, and it is lost by not being recognised.

What a request looks like when it does not look like one. “Can you send me everything you have on me” is obvious. These are not, and each is a request: “Why was my application rejected.” “Stop emailing me.” “That’s not right, I moved two years ago.” “Who told you that about me.” A complaint letter with a request for the file in the fourth paragraph.

What to do. Pass it on the same day, to whatever internal destination your organisation has. Section 35.6 records that the clock started when it arrived, not when the privacy team saw it. You do not have to work out which right it is — section 35.4 records that the trigger is the subject matter.

What you may tell them. That you are passing it on and who will respond. That a system was involved in a decision, if one was — section 65.7 records that this is not confidential.

What you must not do. Answer it yourself from what you can see on screen. Tell them to put it in writing on a specific form — section 35.3 records that a request is valid however it arrives. Or delay it because the person who handles these is away.

Collected from every situation above, because these are the ones that do not depend on your role.

Anyone asking you to change, remove or re-date a record. Section 65.2.

Anyone asking you to skip a step because of time pressure. Sections 65.6, 65.8 and 65.13.

A volume of work that does not allow you to do it properly. Section 55.13.

Something that looks like it might have gone wrong at scale — a pattern in outcomes, a mis-sent file, a system nobody is monitoring. You do not need to be sure.

Data or equipment somewhere it should not be.

And anything you are being asked to attest to that you cannot check. Section 38.16: do not sign off a form describing a process you do not perform.

The situations the lens blocks work through, collected, because these are the ones that actually happen.

“The laptop is needed urgently for a new starter — skip the wipe.” Section 36.16: do not. The device is going to a different person. Escalate rather than argue, and offer a loan device.

“Clear the backlog, approve at volume.” Section 40.40: the oversight obligation is discharged through you. Say what rate allows genuine consideration and escalate the gap in writing.

“Collect the biometrics now, get the release signed later.” Section 43.22: the consent must precede the collection.

“Complete the assessment for this project and date it earlier.” Section 38.16: complete it, dated today, recording that the processing began first. The gap is a finding; the false date is worse.

“Soften the risk you recorded.” Section 38.16: the mitigation can be discussed. The description of the risk is what you observed. If pressed, ask for the change to be made by the person requesting it, in their name.

“Confirm the training you did not complete.” Section 38.16: do not. Say what you did complete.

The general shape. Escalate rather than refuse on the spot, name the specific thing you cannot do, and put it in writing. You are not being asked to win the argument.

Not treated anywhere else in the document, and it is the situation people are actually in when they start reading.

You collected something you should not have. You approved at volume for six months. You skipped a wipe. You did not pass on a request.

What to do. Say so now, and record it dated now. Section 56.6 records the equivalent for a system classified late: classify it now, dated now, recording that it was deployed before classification. The gap is a finding.

What not to do, and it is the same rule as section 65.2. Do not back-date anything. Do not quietly fix the record. Do not wait to see whether anyone notices — section 37.4 records that in a breach the clock starts on awareness, and an organisation that learns late is worse off, not better.

What will probably happen. Less than you fear. Section 39.7 records that a documented failure is treated differently from an undocumented one, and the same logic operates internally: an organisation that finds out from you can fix it, and one that finds out from a regulator cannot.

The exception worth naming. If what happened may have exposed other people’s data, it is urgent rather than merely important, and section 37.4 records why the timing matters.

This section exists because every other treatment of this lens tells you what to do and none tells you what you need in order to do it.

Training that is about your job. Section 38.11 records that the annual module produces evidence of delivery and does not change behaviour at the moments that matter, and that role-specific content delivered at the point of the decision works better.

An escalation route you know. Section 38.11: the single most valuable thing a front-line member of staff can know is who to ask. If you do not know, that is a gap in the organisation, not in you.

Time. Section 55.13 records it as one of three requirements that cost money and are frequently omitted.

Authority. Section 55.13 and section 40.40: if you are an overseer, you must be able to depart from the system’s output without seeking approval from someone who will not give it. A role without that is section 38.15’s failure applied to a person.

And not to be penalised for escalating. Section 38.8 records that a data protection officer may not be dismissed or penalised for performing their tasks. The equivalent protection for you is usually a whistleblowing policy rather than data protection law, and knowing which applies is worth finding out before you need it.

What to do if you do not have these. Say so, in writing, once. Section 65.2: you are the evidence, and that includes evidence of what you asked for.

One per situation, from the lens blocks, collected.

Generally. You are the evidence. Write down what actually happened, when it happened, and do not improve it later.

Collecting. Useful is not necessary.

Equipment and paper. Section 36.16: anything that ever held personal data leaves the building by one route only, and you do not decide which things those are.

Screening tools. Section 43.22: consent before collection, notice before decision, and never describe who or what made a decision differently from how it was actually made.

Oversight. Section 40.40: you were put there to be able to say no, and a system that has never been overridden is evidence that the oversight is not working.

Standards. Section 53.21: a standard tells you what good practice looks like; it does not tell you what the law requires.

Requests. If somebody is asking about their own data, pass it on today.