Privacy operators run DSAR (export, delete, access), consent management, retention, residency, and the privacy-incident first response. They are the operational arm of the privacy program.
Audience and prerequisites#
- Audience: compliance and privacy staff plus on-call privacy operators.
- Prerequisites: legal-privacy foundations, GDPR/CCPA/regional jurisdictions module, RBAC current, evidence-preservation training.
- Refresh cadence: 6 months; per-regulator update mandatory micro-brief.
Learning objectives#
By certification, a privacy operator can independently:
- Process a DSAR end-to-end: identity verification, scope confirmation, export, delivery, audit, follow-up.
- Process a deletion request: scope, dependencies, retention exceptions (legal-hold), verification.
- Manage consent: capture, withdrawal, propagation across caches and downstream jobs, audit.
- Apply retention policy per data class and residency; recognize and resolve retention violations.
- Run the first response on a privacy incident per
docs/runbooks/privacy-incident.md, including evidence preservation and notification scope. - Coordinate with legal, security, and tenant administrators for B2B-contract privacy obligations.
Curriculum modules#
| # | Module | Duration | Format | Assessment |
|---|---|---|---|---|
| 1 | DSAR end-to-end (export, delete, access) | 180 min | hands-on against staging | 3-DSAR drill (one of each) |
| 2 | Consent capture and withdrawal propagation | 120 min | hands-on with consent tooling | 5-consent drill |
| 3 | Retention policy and residency | 120 min | seminar + class-by-class cards | 20-item retention/residency test (≥ 18/20) |
| 4 | Privacy-incident first response (joint with runbook owner) | 120 min | scenario rehearsal | runbook walkthrough pass |
| 5 | Evidence preservation and audit-grade records | 90 min | guided + peer review | rubric pass on 5 audit packets |
| 6 | Regulator notification and subject notification | 120 min | drafting workshop with legal | 2-notification drill (regulator + subject) |
| 7 | Tenant and B2B privacy contracts | 60 min | walkthrough of contract clauses | 3-clause interpretation drill |
| 8 | Cross-system privacy: assistant, memory, evidence, billing | 90 min | hands-on across subsystems | per-subsystem privacy-mapping pass |
DSAR end-to-end protocol#
- Receive the DSAR (web form, message-center, email).
- Verify identity using the canonical verification flow; for special-category data (minors, biometrics, health), elevate to an identity-verification supervisor.
- Confirm scope: residency, data classes, time window. Capture as a structured impact-scope record.
- Run the request:
- Export: enqueue the export job; the inner provenance manifest is generated by the provenance pipeline.
- Deletion: enqueue against the documented predicate; preserve legal-hold rows; record verification.
- Access: enqueue the access summary; deliver under TLS to the verified channel.
- Deliver to the subject through the documented channel; capture delivery audit.
- Audit close-out: confirm every downstream cache, queue, and index has been propagated against; close the case in the privacy registry.
Consent management protocol#
- Consent is captured per data class with the canonical purpose statement; the customer sees the disclosure copy from the i18n catalog.
- Withdrawal must propagate to every cache, every downstream job, and every analytics emission within the documented SLA (24 h max).
- Special-category consent (minors, biometrics, health) is treated as high-risk; withdrawal triggers immediate processing-halt and audit ping.
Retention and residency protocol#
- Every data class has a published retention period and a residency region.
- Retention violations (data kept beyond policy) are sev2 incidents.
- Residency violations (data processed in a forbidden region) are sev1 incidents; route to the privacy-incident runbook.
- Vendor sub-processor retention is reviewed quarterly; vendor-incident packets are evaluated for residency exposure.
Scenario rehearsal#
- Cross-tenant DSAR: a DSAR is submitted by a tenant administrator for their tenant's data; operator scopes against tenant boundary, runs the export, verifies no cross-tenant data is exposed.
- Deletion with legal-hold conflict: a deletion request conflicts with an active legal-hold; operator pauses deletion, captures the hold, communicates with the subject under the legal-reviewed template.
- Consent withdrawal during active assistant session: a customer withdraws memory consent mid-session; operator force-flushes consent cache, observes the assistant fall to memory-off mode, captures the audit.
- Privacy incident first response: a cross-tenant memory write is detected; operator preserves evidence, freezes affected exports and deletions, hands off to the privacy-incident runbook commander.
- Regulator notification under Article 33: a sev1 incident requires a regulator notification within 72 h; operator drafts the notification, captures legal review, delivers via the documented channel.
Certification criteria#
- All 8 modules complete with passing assessment.
- All 5 scenarios passed.
- Operator has shadowed 5 DSARs end-to-end with a certified privacy operator.
- Operator has co-led 1 privacy-incident drill end-to-end.
- Privacy lead and legal counsel sign-off.
Tabletop drills#
- Per-regulator update: mandatory micro-brief on the change.
- Quarterly: DSAR-under-load drill alongside support.
- Semiannually: privacy-incident tabletop with security and compliance.
Owner#
Privacy lead owns this training. Legal counsel, security lead, and compliance lead co-review. Updates require all four sign-offs for regulator-touching modules.