My company uses the OneTrust tool. We have launched multiple processing activitiy questionnaires to our HR department and have received very little responses. Of those reponses we have received most respondents have skipped questions. What’s the best approach to gather information? Informal meetings with departments on why the questionnaires are being sent? How do we get the company engaged when it comes to privacy and completing the questionnaires? Any suggestions will be much appreciated.
Getting others to see data protection procedures as part of their day job is difficult, and unfortunately the one thing that makes our job easier is often considered to be a complete bind by our colleagues.
Sending questionnaires ‘blind’ won’t enamour you to them. Some people will see it as disrespectful of their role and workload. Others see it as you asking them to do your job for you.
I suggest you treat the questionnaire as the ‘follow up’ after a conversation. Not least because some of the language will be non-sensical to a non-privacy professional. Invite your colleagues into the process, talk about why you need their input and how valuable their contribution is to you and the organisation as a whole. See where you can help them out by completing some of the questions in advance.
Also manage expectations. If the questionnaire is going to take 90 minutes to complete, tell them that and ask when they can reasonably complete it by.
p.s. do correct the US grammar and spelling!
I would completely agree with HellenB here. Going in cold with colleagues is going to throw up walls, and it’s often the conversations before where you can explain what you’re going to do and why it is important to the organisation, these are invaluable.
People can often feel like they’re being audited, being audited feels like you’re being questioned, like you’ve done something wrong. When undertaking these types of exercises, I’ve always tried to convey that we’re not the Data Protection Police, more like the Data Protection Paramedics -it’s extremely rare that someone turns the paramedic away.
Agree with previous responders and their great advice. I have tackled this in the past by pre completing as much as I can in advance and then setting up a workshop to walk through the questionnaire or RoPA together. Much more hard work for me, but the end result is that the business see I have done the heavy lifting and are willing to cooperate for the final hurdle.