1. RESPONSIBILITIES AND ROLES
This section defines organizational positions and PDP roles responsible for personal-data processing and protection. Each role is accountable for compliance and retention of evidence associated with its functions.
Cloud and Cybersecurity Lead
Ensure compliance with this Policy
CEO
Request reviews of the Policy when considered appropriate to ensure compliance and improvement, and approve the Policy.
IT Process Improvement Lead
Ensure that the Personal Data Processing and Protection Policy complies with the standards established in SIGI, and publish and maintain the Policy in SIGI.
All positions/roles
Ensure practices consistent with information security policies and safeguard the confidentiality of data.
CEO - PDP role
Approves the Policy, allocates resources, appoints the Data Protection Officer and is accountable for the organization's demonstrated accountability.
Data Protection Officer / DPO
Supervises compliance, advises the organization, maintains the ROPA, coordinates DPIAs, manages breaches, and acts as the point of contact with authorities and data subjects.
Data Controller
Determines the purposes and means of processing and ensures the legal basis, authorization, and rights of data subjects.
Data Processor
Processes data on behalf of the controller, following instructions, contractual obligations (DPA), and security measures, while retaining evidence.
Infrastructure & Cybersecurity Lead
Implements and verifies technical security measures, access control, encryption, monitoring, audit logs, and privacy by design in systems.
Process Leaders
Identify, document, and keep processing activities in their processes up to date and ensure compliance with the Policy.
Human Resources
Manages employee and candidate personal data, obtains authorizatio
Help Desk
Receives, records, classifies, and routes data-subject requests and privacy events/incidents, maintaining traceability.
Legal / Contractual Responsible
Validates legal bases, authorizations, privacy notices, standard contractual clauses, and Data Processing Agreements (DPA).
Suppliers, third parties and subprocessors
Process personal data according to Integra's instructions, with contractually required guarantees, controls, and evidence.
Internal users
Apply the principles and controls of the Policy, safeguard confidentiality, and report security and privacy events and incidents.
Information Security Committee or equivalent
Periodically reviews compliance, approves high-risk processing, evaluates privacy risks, and supervises continuous improvement of the PDP framework.
1.1 RACI Responsibility Matrix
R = Responsible; A = Accountable/Approver; C = Consulted; I = Informed. GG = General Management; DPO = Data Protection Officer; LIC = Infrastructure & Cybersecurity Lead; AJ = Legal; MA = Help Desk; LP =Process Leaders; CS = Information Security Committee.
| Actividad de PDP | GG | DPO | LIC | AJ | MA | LP | CS |
|---|---|---|---|---|---|---|---|
| Policy approval and governance | A | R | I | C | I | I | C |
| Legal bases and processing purposes | I | A | I | R | I | C | I |
| Consent and authorization | I | A | I | C | C | R | I |
| ARCO+ rights / requests | I | A | I | C | R | C | I |
| ROPA and inventory | I | A | C | I | I | R | I |
| DPIA/PIA | I | A | R | C | I | C | C |
| International transfers (TIA) | I | A | C | R | I | C | I |
| Processors/third parties and DPA | I | A | C | R | I | C | I |
| Breach management / notification | I | A | R | C | C | I | C |
| Privacy by design/default / technical security | I | C | A | I | I | C | C |
| Retention and secure deletion | I | A | C | I | I | R | I |
| Privacy training and awareness | I | A | C | I | I | R | C |
2. DEFINITIONS
ALCOA+: Data integrity principles: attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, and available.
Anonymization: Irreversible process that prevents direct or indirect identification of the data subject.
Authorization: Prior, express, and informed consent of the data subject to process personal data.
Privacy Notice: Verbal or written communication informing the data subject about applicable processing policies, how to access them, and the intended purposes
Database: Organized set of personal data subject to processing.
Legal basis:Legal ground legitimizing processing, such as authorization, contract, legal obligation, legitimate interest, vital interest, or regulatory obligation.
Personal data breach: Security breach resulting in destruction, loss, alteration, disclosure of, or unauthorized access to personal data.
Special categories of data: Sensitive data under GDPR, Law 1581 and HIPAA that require enhanced safeguards.
Client: Any person using INTEGRA IT S.A.S. services as a user or supplier.
Consent: Freely given, prior, express, informed, verifiable, and revocable indication of the data subject's wishes regarding processing.
Minor's data: Personal data of children and adolescents, subject to the best interests of the child and reinforced controls.
Health data: Personal data relating to a data subject's physical or mental health, considered sensitive and, where HIPAA applies, protected health information.
Personal data: Any information linked or that may be associated with one or more identified or identifiable natural persons.
Private data: Data that, due to its intimate or reserved nature, is relevant only to the data subject.
Public data: Data that is not semi-private, private, or sensitive.
Semi-private data: Data that is neither intimate nor reserved nor public, and whose knowledge concerns the data subject and a sector or group of people.
Sensitive data: Data affecting the privacy of the data subject or whose misuse may generate discrimination, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, affiliations, health, sex life, and biometric data.
Data Protection Officer / DPO: Function responsible for overseeing compliance with the data protection framework and acting as a point of contact with data subjects and authorities.
DPIA / PIA: Data/privacy impact assessment applied to high-risk processing.
Secure deletion: Verifiable and documented destruction, deletion, or anonymization of personal data.
Processor: Natural or legal person that processes personal data on behalf of the controller.
Electronic signature: Electronic symbol or data associated with a record and executed by a person with the intent to sign.
GDPR: European Union General Data Protection Regulation
Security incident: Event that compromises or may compromise the confidentiality, integrity, or availability of information..
Purpose limitation: Collection for specified, explicit, and legitimate purposes without incompatible further processing.
Data minimization: Processing limited to adequate, relevant, and strictly necessary data.
PHI / ePHI: Protected Health Information and its electronic form under HIPAA..
Privacy by default: configuration that processes only necessary data with restricted access and limited purpose
Privacy by design: IIntegration of privacy controls from the conception of processes, systems, and services
Electronic record: Any combination of text, graphics, data, or information in digital format created, modified, maintained, or distributed by a system.
Controller: Natural or legal person that determines the database and/or processing.
Retention: Period for which personal data is retained according to purpose and applicable legal, contractual, and regulatory obligations..
ROPA: Documented Record of Processing Activities covering purposes, categories, legal bases, processors, transfers, security measures, and retention.
Pseudonymization: Processing that prevents attribution to a data subject without separately held additional information protected by enhanced controls..
Subprocessor: Third party contracted by a processor to process personal data on behalf of a controller under equivalent obligations.
TIA: Transfer Impact Assessment for international transfers of personal data.
Data subject: Natural person whose personal data is processed.
Transfer: Sending personal data by a controller and/or processor in Colombia to another controller within or outside the country.
International transfer: Sending personal data to a controller located in another country
Transmission: Communication of personal data, within or outside Colombia, for processing by a processor on behalf of the controller.
Processing: Any operation or set of operations on personal data, including collection, storage, use, circulation, or deletion
3. GOVERNING PRINCIPLES
3.1 Personal Data Processing Principles - Law 1581 of 2012
- Legality
- Purpose limitation
- Freedom
- Truthfulness or quality
- Transparency
- Restricted access and circulation
- Security
- Confidentiality
3.2 Demonstrated Accountability and Privacy Principles
- Demonstrated accountability
- Data minimization
- Storage limitation
- Integrity and confidentiality
- Accuracy
- Privacy by design
- Privacy by default
- Traceability
- Auditability
- ALCOA+ data integrity
4.PERSONAL DATA PROCESSING POLICIES
INTEGRA IT S.A.S. develops and markets software and provides professional consulting, implementation, maintenance, outsourcing, and operational services. In its capacity as the Data Controller and/or Data Processor, Integra establishes the following personal data processing policies based on evidence, traceability, controls, and auditability..
INTEGRA IT S.A.S. | NIT 900311906-7
Cra 45 A 104 B 16, Bogotá D.C. - CO
[email protected] | +57 (1) 316 292 0684
4.1 Data Life Cycle
Manage personal data throughout its entire life cycle, from collection through storage, use, circulation, transfer, transmission, retention, archiving, anonymization, pseudonymization, deletion, and final disposal. Document each stage, the associated responsibilities, risk-based controls, and supporting evidence. Supported by IT-SOP-031.
4.2 Legal Bases
Establish and document the appropriate legal basis for each data processing activity, including authorization, contractual obligations, legal obligations, legitimate interests where applicable, vital interests, regulatory obligations, and the provision of services. Register the applicable legal basis in the ROPA (Record of Processing Activities). Supported by IT-SOP-032..
4.3 Consent and Authorization
Obtain, record, retain, and verify consent or authorization when freely given, prior, explicit, informed, verifiable, and revocable. Provide mechanisms to ensure traceability and enable the withdrawal or revocation of consent or authorization. Supported by IT-SOP-032 and IT-FRM-034.
4.4 Lawfulness of Processing
Before processing personal data, verify that each processing activity has a legitimate purpose, a valid legal basis, and a proportionate relationship between the personal data collected and the stated purpose. Review these conditions periodically. Supported by IT-SOP-032 and IT-FRM-034.
4.5 ARCO+ Rights of Data Subjects
Ensure the rights of access, rectification, cancellation, objection, updating, erasure, withdrawal of authorization, data portability, and restriction of processing, where applicable, as well as GDPR rights related to automated decision-making. Supported by IT-SOP-033 and IT-FRM-032.
4.6Procedure for Handling Requests
Receive, record, classify, verify identity, manage, respond to, and close requests from data subjects through the Help Desk and [email protected], while maintaining end-to-end traceability. Supported by IT-SOP-033 and IT-FRM-032.
4.7 Response Timeframes
Respond to inquiries in Colombia within 10 business days and to complaints within 15 business days, subject to any extensions permitted by law. Where the GDPR applies, respond within one month, extendable as permitted. Supported by IT-SOP-033.
4.8 Data Minimization and Purpose Limitation
Limit the collection and processing of personal data to what is strictly necessary, relevant, and appropriate for informed, legitimate, and authorized purposes. Avoid subsequent processing that is incompatible with those purposes and periodically delete unnecessary data. Supported by IT-SOP-031.
6.9 DPIA / PIA
Conduct impact assessments for new or high-risk processing activities, new technologies, sensitive or health data, children's data, or systematic monitoring. Document identified risks, mitigation measures, and decisions. Supported by IT-SOP-034 and IT-FRM-033.
4.10 Privacy Risk Analysis
Identify, assess, address, monitor, and document risks related to privacy, security, confidentiality, integrity, availability, compliance, and data subject rights. Supported by IT-SOP-034 and IT-FRM-033.
4.11 High-Risk Processing Activities
Apply enhanced controls, impact assessments, and approval by the Information Security Committee to the processing of sensitive data, health data, children's data, large-scale processing activities, international transfers, automated decision-making, profiling, and emerging technologies. Supported by IT-SOP-034.
4.12 International Transfers
Conduct a prior assessment of the destination, safeguards, legal basis, contracts, authorization where required, and transfer traceability, including Articles 44–49 of the GDPR, where applicable. Supported by IT-SOP-035 and IT-FRM-039.
4.13 Appropriate Safeguards
Use contractual, technical, organizational, regulatory, and documentary safeguards for international transfers, including confidentiality, encryption, access controls, and security obligations. Supported by IT-SOP-035 and IT-FRM-039.
4.14 Standard Contractual Clauses
Use Standard Contractual Clauses or equivalent mechanisms when required by the GDPR or applicable data transfer regulations, and retain evidence of their implementation and compliance. Supported by IT-SOP-035.
4.15Data Processors
Manage data processors, sub-processors, and third parties through documented instructions, security obligations, restrictions on use, sub-processing controls, oversight, and audit evidence. Supported by IT-SOP-036.
4.16 Third-Party Due Diligence
Assess third parties before processing begins, considering security, privacy, compliance, location, sub-processors, technical controls, supporting evidence, and contractual requirements. Supported by IT-SOP-036 and IT-FRM-037.
4.17Data Processing Agreements (DPA)
Formalize Data Processing Agreements (DPAs) that address purpose, security, restrictions on use, sub-processors, incident notification, audit rights, and the return or deletion of data upon termination of the relationship, together with confidentiality agreements. Supported by IT-SOP-036 and IT-FRM-038.
4.18 Personal Data Breach Management
Identify, classify, contain, assess the impact of, investigate, document, remediate, extract lessons learned from, and close personal data breaches while assessing the risks to data subjects. Supported by IT-SOP-037 and IT-FRM-040.
4.19 Notification to Authorities
Assess and carry out notifications to the competent authorities, including the SIC in Colombia and European authorities where applicable, in compliance with the required timeframes and notification requirements. Supported by IT-SOP-037 and IT-FRM-035.
4.20Communication to Affected Data Subjects
Communicate personal data breaches to affected data subjects when required based on the level of risk, describing the breach, its potential consequences, the measures taken, and the available contact channels. Supported by IT-SOP-037 and IT-FRM-036.
4.21Privacy by Design
Incorporate privacy controls from the outset and throughout the design, acquisition, configuration, development, implementation, maintenance, and retirement of systems, processes, and services. Supported by IT-SOP-038.
4.22 Privacy by Default
Configure processes, systems, and services to process only the personal data necessary by default, with restricted access, limited purposes, and controls proportionate to the level of risk. Supported by IT-SOP-038.
4.23 Data Protection in System Design
Apply security, traceability, segregation of duties, audit logs, access controls, and validation throughout the development lifecycle, infrastructure, cloud environments, integrations, databases, Odoo, Trial360, and managed solutions. Supported by IT-SOP-038.
4.24 ROPA
Apply security, traceability, segregation of duties, audit logs, access controls, and validation throughout the development lifecycle, infrastructure, cloud environments, integrations, databases, Odoo, Trial360, and managed solutions. Supported by IT-SOP-038.
4.25 Processing Activities Inventory
Maintain an inventory of processing activities across processes, systems, clients, services, suppliers, and technology platforms, aligned with the ROPA and used for risk management and compliance purposes. Supported by IT-SOP-039 and IT-FRM-031.
4.26 Colombian National Database Registry
Assess, maintain, and update registration with the SIC's National Database Registry (RNBD) when legally applicable, and retain the corresponding supporting evidence. Supported by IT-SOP-039.
4.27 Privacy Notices
Create, maintain, publish, and update clear, complete, accessible, and verifiable privacy notices aligned with the purposes of processing and the rights of data subjects, while retaining evidence of version history and publication. Supported by IT-SOP-040.
4.28 Public Data Processing Policies
Maintain publicly available personal data processing policies for data subjects and interested parties, with version control and evidence of availability. Supported by IT-SOP-040.
4.29 Transparency and Information
Inform data subjects about the Data Controller, purposes of processing, rights, communication channels, transfers, data processors, retention periods, security measures, and other relevant aspects of personal data processing. Supported by IT-SOP-040.
4.30 Anonymization
Apply anonymization when necessary, assess the risk of re-identification, document the techniques applied, and periodically validate their effectiveness, including the use of hashing and the removal of direct identifiers where appropriate. Supported by IT-GDE-011.
4.31Pseudonymization
Use pseudonymization to reduce risk by keeping re-identification information separate and subject to enhanced controls, with appropriate documented evidence. Supported by IT-GDE-011.
4.32 Personal Data Retention
Define, document, apply, and periodically review retention periods according to the purpose of processing and justified legal, contractual, regulatory, litigation-related, or operational requirements. Supported by IT-GDE-012.
4.33 Secure Data Disposal
Delete, destroy, anonymize, or otherwise securely and verifiably dispose of personal data once its purpose or retention period has ended, using methods appropriate to the medium and the sensitivity of the information. Supported by IT-GDE-012.
4.34 Retention Exceptions
Retain personal data beyond the standard retention periods only when required for legal, regulatory, contractual, litigation, auditing, security, business continuity, or incident investigation purposes, provided that such exceptions are properly documented and have a defined duration. Supported by IT-GDE-012.
4.35 Technical Security Measures
Implement access controls, authentication, encryption, monitoring, backups, segregation of duties, system hardening, audit logs, vulnerability management, and protection of endpoints, networks, databases, and cloud platforms. Supported by IT-GDE-013.
4.36 Encryption
Encrypt personal data in transit and at rest, manage the lifecycle of encryption keys and credentials, use secure communication channels, and strengthen the protection of sensitive and health-related data. Supported by IT-GDE-013.
4.37Access Controls
Apply the principles of need-to-know, least privilege, segregation of duties, strong authentication, periodic access reviews, timely revocation of access, and traceability. Supported by IT-GDE-013.
4.38 Multi-Jurisdictional Compliance
Identify and manage privacy obligations based on the country, client, contractual requirements, type of data, location of the data subject, place of processing, and international data transfers. Maintain an up-to-date obligations map. Supported by IT-GDE-014.
4.39 Country/Jurisdiction-Specific Requirements
Document the specific requirements of each applicable jurisdiction, including Colombia, the EU/EEA, the United States where HIPAA applies, and other relevant countries. Such requirements shall include the applicable legal framework, competent authorities, legal bases, rights, special categories of data, children's data, data transfers, data breaches, records, and supporting evidence. Supported by IT-GDE-014.
4.40 Sensitive Data
Protect sensitive data through explicit authorization where applicable, access restrictions, enhanced safeguards, risk assessments, purpose limitation, and appropriate technical controls. Supported by IT-GDE-015.
4.41 Health Data
Protect health data and PHI/ePHI where applicable, ensuring confidentiality, integrity, availability, and traceability, while taking into account HIPAA privacy and security requirements, contractual obligations, and enhanced technical controls. Supported by IT-GDE-015.
4.42Children's Data
Process children's personal data in accordance with applicable legislation, the best interests of the child, authorization from the legal representative where required, a legitimate purpose, data minimization, and enhanced safeguards. Supported by IT-GDE-015.
4.43 Special Categories of Personal Data
Identify, classify, and control special categories of personal data in accordance with the GDPR, Colombian Law 1581, HIPAA, and other applicable regulations, applying enhanced safeguards and risk assessments. Supported by IT-GDE-015.
4.44Clinical Research and Digital Health
Ensure an applicable legal basis and/or valid consent, anonymization or pseudonymization where appropriate, compliance with ICH-GCP and ALCOA+ principles, full lifecycle traceability, and restrictions on secondary uses of personal data.
4.45 Responsible Use of Artificial Intelligence
Before implementing AI, conduct risk assessments, apply Privacy by Design and data minimization principles, ensure human oversight where appropriate, prevent bias, maintain transparency and model traceability, and prohibit the use of personal data for model training without a valid legal basis.
5. APPLICABLE LEGAL FRAMEWORK
The framework distinguishes mandatory legal requirements from adopted standards, reference frameworks, and requirements applicable to regulated environments. Applicability depends on the data subject, the type of data, the scope of processing, and the applicable jurisdiction.
5.1Law 1581 of 2012 – Colombia
Applies to the processing of personal data in Colombia, including applicable principles, the rights and obligations of data controllers and data processors, authorization, inquiries, and complaints.
5.2 Decree 1377 of 2013
Applies to authorization, privacy notices, purposes of processing, data subject rights, and processing policies.
5.3GDPR
Applies when the territorial or extraterritorial scope of the EU GDPR is met and covers principles, legal bases, consent, special categories of personal data, data subject rights, Privacy by Design and by Default, data processors, ROPA, security, data breach notifications, DPIAs, and international data transfers.
5.4 HIPAA – Where Applicable to PHI
Applies to Protected Health Information (PHI) where applicable, including the administrative, physical, and technical safeguards required under the Privacy and Security Rules.
5.5 Other Jurisdictions
Integra assesses applicable requirements based on the country, client, contract, location of the data subject and processing activities, data processors and sub-processors, data transfers, and the nature of the data. The jurisdictions covered include Chile (Law 21.719), Argentina (Law 25.326), Panama (Law 81 of 2019), and Paraguay (Law 7593/2025).
7.6 ISO/IEC 27001:2022
Used to align information security practices related to risks, access controls, incidents, business continuity, suppliers, assets, encryption, and monitoring.
7.7 ISO/IEC 27701:2019
Used as an extension for privacy management, covering the roles of data controllers and data processors, PII-related obligations, data subject rights, third parties, data transfers, data minimization, and data retention.
5.8 NIST Privacy Framework
Aligned with the Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P functions.
5.9GAMP 5 Second Edition
Applied, where appropriate, to regulated computerized systems, including lifecycle management, risk-based approaches, traceability, validation, and change control.
7.10 21 CFR Part 11
Applied, where appropriate, to electronic records and electronic signatures, including access controls, audit trails, data integrity, record retention, traceability, and system controls.
5.11 ALCOA+ Data Integrity
Ensures that personal data and regulated records remain attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, and available.
Chile:
Law 21.719; Personal Data Protection Agency; rights of access, rectification, erasure, objection, data portability, and restriction of processing; enhanced protection for children's data; and requirements for international data transfers.
Argentina
Law 25.326; data quality, consent, sensitive data, habeas data, and rights of access, rectification, updating, and erasure.
Panamá
Law 81 of 2019; principles of fairness, purpose limitation, transparency, proportionality, and security; ARCO rights; incident management; and communication to data subjects.
Paraguay
Law 7593/2025; extraterritorial scope, data subject rights, international data transfers, data processors, and data controllers.
6. REFERENCES
In the event of a conflict among the applicable sources, mandatory applicable legislation shall prevail, followed by adopted standards and Integra's internal documentation.
- Political Constitution of Colombia, Article 15
- Law 1581 of 2012
- Regulatory Decree 1377 of 2013
- Decree 1074 of 2015, where applicable
- Ruling C-748 of 2011 of the Constitutional Court of Colombia
- Guidelines of the Superintendence of Industry and Commerce (SIC)
- General Data Protection Regulation (GDPR)
- HIPAA Privacy Rule
- HIPAA Security Rule
- ISO/IEC 27001:2022
- ISO/IEC 27701:2019
- NIST Privacy Framework
- GAMP 5 Second Edition
- 21 CFR Part 11
- ALCOA+ Data Integrity Principles
- Integra IT Internal Information Security Policies
- PDP Framework Procedures, Guidelines, Forms, and Records: IT-SOP-031 to IT-SOP-040, IT-GDE-011 to IT-GDE-015, IT-FRM-031 to IT-FRM-040
6.1 Traceability with the Personal Data Protection Document Framework
| PDP Document | Code | IT-POL-002 Sections | Evidence / Record | Suggested Responsible Party |
|---|---|---|---|---|
| Data Lifecycle Management | IT-SOP-031 | 5; 6.1; 6.8 | Data lifecycle records | DPO / Process Leader |
| Consent and Legal Bases | IT-SOP-032 | 6.2; 6.3; 6.4 | Records of authorizations and legal bases | DPO / Legal |
| ARCO Rights and Requests | IT-SOP-033 | 6.5; 6.6; 6.7 | Data subject request records | Help Desk / DPO |
| DPIA/PIA | IT-SOP-034 | 6.9; 6.10; 6.11 | Documented DPIAs | DPO / Infrastructure & Cybersecurity Lead |
| International Data Transfers | IT-SOP-035 | 6.12; 6.13; 6.14 | TIAs and contracts | DPO / Legal |
| Data Processors and Third Parties | IT-SOP-036 | 6.15; 6.16; 6.17 | Due diligence and DPAs | DPO / Legal |
| Personal Data Breach Notification | IT-SOP-037 | 6.18; 6.19; 6.20 | Breach and notification records | DPO / Infrastructure & Cybersecurity Lead |
| Privacy by Design and by Default | IT-SOP-038 | 6.21; 6.22; 6.23 | System design evidence | Infrastructure & Cybersecurity Lead |
| ROPA | IT-SOP-039 | 6.24; 6.25; 6.26 | ROPA and processing activity inventory | DPO |
| Privacy Notices and Policies | IT-SOP-040 | 6.27; 6.28; 6.29 | Published notices and policies | DPO / Communications |
| Anonymization and Pseudonymization | IT-GDE-011 | 6.30; 6.31; 6.1 | Evidence of applied technical measures | Infrastructure & Cybersecurity Lead |
| Retention and Deletion | IT-GDE-012 | 6.32; 6.33; 6.34 | Retention schedules / deletion records | DPO / Process Leader |
| Encryption and Technical Protection | IT-GDE-013 | 6.35; 6.36; 6.37 | Security/key configuration | Infrastructure & Cybersecurity Lead |
| Multi-Jurisdictional Compliance | IT-GDE-014 | 6.38; 6.39; 6.12 | Jurisdictional obligations map | DPO / Legal |
| Special Categories of Data | IT-GDE-015 | 6.40; 6.41; 6.42; 6.43 | Sensitive data records | DPO / Process Leader |
| ROPA Form | IT-FRM-031 | 6.24; 6.25 | Completed ROPA | DPO |
| Data Subject Rights Request | IT-FRM-032 | 6.5; 6.6 | Registered requests | Help Desk |
| DPIA Form | IT-FRM-033 | 6.9; 6.10 | Completed DPIA | DPO |
| Informed Consent Form | IT-FRM-034 | 6.3; 6.4 | Recorded consents | Legal / DPO |
| Personal Data Breach Notification to the Authority | IT-FRM-035 | 6.18; 6.19 | Notification to the SIC | DPO |
| Personal Data Breach Notification to the Data Subject | IT-FRM-036 | 6.18; 6.20 | Communications to data subjects | DPO |
| Data Processor Due Diligence | IT-FRM-037 | 6.15; 6.16 | Third-party assessment | DPO / Legal |
| Data Processing Agreement | IT-FRM-038 | 6.15; 6.17 | Formalized DPAs | Legal |
| International Data Transfer Assessment | IT-FRM-039 | 6.12; 6.13 | Completed TIA | DPO / Legal |
| Personal Data Breach Register | IT-FRM-040 | 6.18 | Breach register | DPO / Infrastructure & Cybersecurity Lead |