Data Protection & Privacy Leadership
Accountability under GDPR sits with the organisation, and its leadership answers for it.
Showing the regulator how data protection is governed, not just documented.
Why it's on the leadership agenda
GDPR has applied since May 2018, but enforcement has matured. Regulators now examine governance: who decided, what leadership knew, and whether the Data Protection Officer was resourced and heard.
A personal data breach must be notified to the regulator within 72 hours of becoming aware of it. The decisions taken in those hours are leadership decisions, and they are reviewed afterwards.
The rules are also moving. The Digital Omnibus proposes changes to how GDPR treats pseudonymised data, AI training and breach reporting. Leadership teams should follow those negotiations, but should not assume they will reduce existing duties.
What the module covers
The accountability principle: what leadership must be able to demonstrate, and how
The role, independence and reporting line of the Data Protection Officer
Breach response: decisions, timelines and communication in the first 72 hours
High-risk processing, impact assessments and where leadership should be involved
Transfers outside the EEA and processing by suppliers, including cloud and AI providers
The proposed Digital Omnibus changes and what they would and would not alter
What your leadership team will be able to answer
Can we show the regulator how data protection is governed, not just documented?
Does our DPO have the access, resources and independence the law requires?
Who decides whether a breach is notifiable, and how quickly can we decide?
Where are our highest-risk processing activities, and when did the board last review them?
How exposed are we through processors and transfers outside the EEA?
The regulatory frame
Accountability for compliance, DPO independence, breach notification within 72 hours (Art. 33). Fines up to EUR 20m or 4% of worldwide turnover (Art. 83).
Applied from 25 May 2018
Irish implementation, with the Data Protection Commission as lead supervisory authority for many multinationals.
In force
Proposed changes to personal data definitions, AI training, cookie consent and a single reporting point for incidents.
Under negotiation
Dates reflect the position as of September 2026. Every engagement begins with a current regulatory review.
What you leave with
An assessment of how well leadership can demonstrate accountability today
A review of the DPO's position, resourcing and reporting line
A tested breach decision process, run against a realistic scenario
A leadership view of the highest-risk processing and transfer exposures
A prioritised action plan, with owners and review dates