Personal data duties
If you cannot explain a record, you do not control it.
Data-protection work here is an operating file: inventories, bases, processors, retention and the path for a human request. It is written for Moldovan operators who also face European counterparties asking for GDPR-grade answers.
Mandate B
Data protection
Purpose
Give management a defensible account of personal data: employees, customers, website enquiries, CCTV if you have it, vendors who host mail or backups. The file should survive a complaint, a counterparty due-diligence sheet, or an internal incident.
Scope
Record of processing, lawful-basis map, notice outline, processor due-diligence checklist, retention schedule, access and deletion path, incident playbook. Default scope excludes acting as data protection officer of record, forensic recovery, and litigation. Cross-border transfer questions are mapped; legal opinions on adequacy sit with counsel.
Process
System list and contract reading, owner interviews, gap matrix, drafting, a table-top on a subject request, close-out with residual issues (for example a vendor who will not sign a processor clause).
Deliverables and customer
Registers and playbooks in language staff can use, plus a short management note on what remains unfixed. Intended for professional firms, trading offices, licensed operators and any team whose briefing starts with “our privacy text was copied from a template”. Site enquiry handling is described in the privacy policy.