NDPA modules · Your data protection officer
He is meant to challenge the credit model. He reports to the man who owns it.
Appointing an officer is the easy half. The Act expects the role to be independent enough to disagree — and a reporting line drawn on any org chart will tell you in about four seconds whether it is.
Two conflicts, one of them cheap to fix
Your auditor rejected this answer, and was right to
You answered that the officer is independent of the processing, and named him. Every formal box is ticked — named to the Commission, published in the notice, trained on an accredited course. The rejection came from the org chart, not the paperwork.
Critical
He also runs fraud operations
Anti-fraud screening is his own team's work, so he would be reviewing his own processing. This is the half that cannot be argued away — no title, no policy and no undertaking makes somebody an independent reviewer of themselves.
High
He reports to the Chief Risk Officer
The CRO owns the credit model the officer is meant to challenge. A reporting line into the business he oversees is the more fixable half of this — and the one the Commission asks about first.
Two ways out, and they are not equal
One is a memo. The other is a reorganisation.
Asiri names both and says which is cheaper, rather than raising a finding and leaving you to work out what it would take. Most companies do the memo first because it is real progress, not because it is complete.
- A board minute
Move the reporting line to the board
The cheaper fix, and the one the Commission asks about first. It removes the high-severity conflict and leaves the critical one untouched.
- A reorganisation
Move fraud operations to someone else
Removes the conflict properly, because he stops reviewing his own team’s processing. It is also a real reorganisation with real people attached.
A third route exists and Asiri will say so: appoint somebody outside the company. A fractional DPO has no operations to review and no line manager inside the business, which removes both conflicts at once for less than the reorganisation costs.
0.4 of a full-time role
The second thing an auditor checks is how many hours the job actually gets
Two days a week across twelve activities, nine suppliers, thirteen live requests, two incidents and an annual return. GAID also requires a written report to management twice a year — one exists for the first half of 2025, and nothing exists for the second.
That missing report is finding F-014-4, and it is the one nobody has replied to.
What the role carries
- Registers to keep current
- 12 activities · 9 suppliers
- Live rights requests
- 13 · two of them late
- Incidents this period
- 2 · one notified late
- Reports to management
- 1 of 2 written
- Time the role actually gets
- 0.4 FTE