How this works: the owner and the reviewer

Version 1, 18 October 2026.

1. Who does what

Role	Responsible for	Not responsible for
Owner	Acts for the controller. Keeps the evidence current, fixes gaps, proves each fix, and makes the controller's decisions (for example High Risk Processing).	Approving his own fixes.
Reviewer (DPO)	Reviews findings, checks the proof for each fix, and gives written advice.	Reading code. Making the controller's decisions. Doing the fixes.
Dembri Privacy Records	Collects evidence, screens, proposes findings, and keeps the record and audit log.	Legal decisions. Privacy Records screens and proposes; people decide.

Rule: the owner decides and the DPO advises. The DPO can always answer "insufficient evidence". That is a valid answer, not a failure.

2. The monthly cycle

The DPO has 2 hours a month. The owner prepares everything before the DPO session.

When	Who	What	Time
Week 1	Privacy Records	The monthly re-scan runs.	0
Week 1 to 3	Owner	Works the "Your actions" list: fixes, proof, replaced documents, HRP facts.	As needed
3 working days before the session	Owner	Checks that "Your actions" is empty or explained.	15 min
Session (week 4)	DPO	Works the "Your actions" list, in the order of section 3.	Up to 2 h
After the session	Owner	Acts on returned claims and advice.	As needed

Dembri Privacy Records emails each person when something waits for them. You do not need to track files or emails. "Your actions" on the engagement page is the only list.

3. Procedures

P1. Re-scan (owner)

When: monthly (automatic), after a large change to the product, and before a filing.
Why: findings are only as current as the evidence.
How: before the run, mark old documents as replaced (P7). Then open the engagement and start a new run (Confirm and start).

P2. Review a new finding (DPO)

When: the session after the finding appears.
Why: a finding is a proposal until a person reviews it.
How: read the finding, its evidence and its citation. Choose one:
Accepted: the gap is real. Give the owner a due date.
Needs revision: the finding is wrong or unclear. Say why.
Mitigated: the gap is already closed and the evidence shows it.

P3. Fix a finding and claim the fix (owner)

When: before the due date.
Why: the DPO cannot read code, so the proof must show the result.
How: fix the gap. Then open the finding, click Claim fix, and fill in:
What changed: one or two plain sentences.
How it was tested: a test that another person could repeat, for example "counted files without a record in the production database".
Result: the number or the observed outcome, for example "0 files without a record".
Tested on: the date.
Attachments (optional, up to 5): a query result, a screenshot or a signed document. They are kept with the finding and are not sent to AI providers.
Tick the confirmation that the engagement's documents are current.
Confirm again when Privacy Records shows "confirmation needed" on a claim. This happens after a new scan moves your claim to a new report. The DPO cannot verify the claim until you confirm.
Good proof is a result. A pull request number or "the code was changed" is not proof for a non-technical reviewer.

P4. Verify a fix claim (DPO)

When: in the session.
Why: an independent check before a gap is closed.
How: open the claim. Read the evidence summary: what changed, the test, the result, the date and the attachments. Then choose one:
Verify: mitigated: the test fits the finding and the result shows the gap is closed.
Return: not fixed yet: write what is missing, for example "please add a second check next month". The owner gets an email.
You are not expected to read code. If the proof needs technical knowledge to judge, return it and ask for a result you can check.

P5. Confirm carry-over suggestions (DPO)

When: in the first session after a re-scan.
Why: after a re-scan, a finding can change its wording. Its earlier status does not move by itself.
How: on the new finding, the panel "Earlier decision may apply" shows the old finding and the new one side by side. Click Confirm if they describe the same gap; the earlier status and proof move to the new finding. Click Different issue if not.
A verified fix that a new scan finds again comes back as "fix claimed, confirmation needed". The owner checks the fix and confirms again (P3, last step). Then the DPO verifies it again (P4).

P6. High Risk Processing assessment (owner, then DPO, then owner)

When: before the DIFC notification, and again when a trigger happens (see the HRP record), for example identity documents switched on or the first real tax return.
Why: the answer decides the notification content, the DPIA timing and whether Regulation 10.3.3 applies.
How: open the assessment from the Assessments list on the engagement page.
Owner: enter the facts with their dates. For each limb (a) to (d), give a position: met, not met or insufficient evidence, with a reason. The Privacy Records screening is shown next to each limb.
DPO: give advice for each limb and overall: agree, disagree or insufficient evidence, with a note.
Owner: make the controller determination: yes, no or undetermined, with a reason. Sign with your password. A different account must give the advice and the determination.
To change a determined assessment, click Re-open as a new version. The earlier versions stay in the history.
A limb that Privacy Records screens as "unknown" stays visible until the owner gives a reasoned position.
If the DPO is not sure, answer "insufficient evidence" and name the question for counsel.

P7. Replace an old document (owner)

When: when a newer version of a document exists.
Why: old drafts make Privacy Records propose findings from out-of-date facts.
How: in the documents list, click Mark as replaced, and optionally name the new document. It stays in the history and in earlier reports. New scans do not use it. Click Use again to undo.

P8. Approve the DPIA report (DPO)

When: after the open high and critical findings are reviewed, and the HRP assessment is determined.
How: the existing approval flow, with password re-entry and the approval statement.

P9. Urgent matters (outside the cycle)

Personal data breach: the owner tells the DPO at once. Do not wait for the monthly session. Follow the reply times in the DPO's appointment terms.
Commissioner inquiry or a data subject request with a deadline: the same as a breach.

4. What Privacy Records emails you

You are	You get an email when
DPO	a fix is claimed; an assessment waits for your advice
Owner	a claim is returned; the DPO has given advice on an assessment

Emails carry only the engagement name and the type of event. The details are in Privacy Records.