Automation for DPOs

DEADLINES YOU CANNOT MISS

• up to ₽500m
• turnover-based fine for a repeat leak since 30.05.2025; the operator is liable, not the tool
• Caveat. We use an AI assistant on PD ourselves, so we apply all the criteria in this presentation to our own work too

Cost of error

high

low

• rare
• Task frequency
• often

Expert decides

Tool prepares, DPO decides

Template suffices

Full automation

EXAMPLE. SUBJECT REQUEST ON THEIR PD

Script

Logging and 10-business-day countdown

Script

Finding subject records by exact data

AI

Request analysis and draft reply

Human

Ruling on disputed points, signing the reply

Script

Logging that it was sent

• PERFORMER
• WHAT IT DOES AND WHAT SETS IT
• DPO EXAMPLES

• No text understanding. Defined by the algorithm, input, output and a list of false positives
• Deadlines, matching the register to the systems list, exact-value search

• Reads and reasons. Defined by instruction, criteria and prohibitions
• Classifying a request, instruction markers in a contract, a DLP finding in context

• Decides at decision points. Gets a signal with options and consequences, while the rest of the work goes on
• Classifying an incident, CBT to a new country, accepting residual risk

ALLOCATION RULES

• 1
• One step, one performer

• 2
• A mixed step is split in two: the script selects candidates, the AI reviews them

• 3
• A script finding becomes a fix without review only if the answer is unambiguous

• 4
• Every change comes with a backup copy and a before-and-after check

• what it covers
• where the limit is

• CRITERION
• VENDOR QUESTION
• RED FLAG

• 1
• Legal timeliness
• Who updates for law changes and how fast, where the as-of date is shown
• Undated, unsigned templates, references to repealed rules

• 2
• Traceability
• Can any conclusion be traced to a provision, RKN position or court decision
• Conclusion with no source, black box

• 3
• The tool as a PDIS

• deal-breaker
• Where data is hosted, who the processor is, what protection level
• Servers or AI model abroad, no processing instruction

• 4
• Evidentiary value
• Which acts, logs and reports it gives and if RKN accepts them
• Dashboard instead of a document

• 5
• Embeddability
• Do process owners work in the system, are there integrations with EDMS, HR and CRM
• Only the DPO uses the system

• 6
• Exit from the system
• In what format registers and logs export, what happens to data after termination
• Export only to PDF, data locked at the vendor

• 7
• Full cost
• What implementation, population, support and DPO time cost
• Licence price only, population falls on you

• 8
• Roadmap
• How the product will react to changes, e.g. the draft consent platform in ESIA
• No plan or update history

Each criterion scores 0 to 2 with weights set to company needs. A deal-breaker voids the result whatever the total

register, contracts, requests, incidents

• 1
• 2
• 3
• 4

if the model or support is abroad

1

2

3

4

Deal-breaker. Without a processing instruction and localisation the tool fails whatever its score, even if it is the most convenient

1

2

3

4

THREE VENDOR QUESTIONS

250

questions from real DPO practice

50

dialogues of 5 questions test context retention

3

blocks of criteria per question instead of a reference text

Example question What are the deadlines to notify RKN of a PD leak?

• Required
• 24 hours for initial notification, 72 hours for investigation results, Art. 21(3.1) of Law 152-FZ

• Ideally
• Count from detection of the incident, content of the notice, liability for failure to notify under Art. 13.11(11) of the CAO

• Unacceptable
• GDPR's 72 hours as the only answer, confusion with the notification of PD processing, invented fine amounts

riskier

vs

W. Siberian Ct, 14.05.2026, CASE No. A27-7831/2025

• 50 000 ₽
• fine for a complaint with invented and foreign acts; the court noted AI does not remove liability

The stop-condition threshold is fixed before the test, not tuned to the result

contract signing

• 1
• Sham register. Filled from questionnaires without interviews, but RKN looks at actual processing

• 2
• Green dashboard. The illusion of compliance takes the topic off management's agenda

• 3
• System only for the DPO. A new project, contractor or website form should generate a task by itself

• 4
• Templates instead of thinking. Consents and policies look right until checked against purposes

• 5
• Shadow AI. Staff already upload PD documents to public chatbots; a lawful alternative is needed

• 6
• Vendor lock-in. Shows up at termination, so the exit plan is written before signing

List your ten most frequent tasks and the time they take per month

Place them on the frequency and cost-of-error matrix

For automation candidates, fill in the eight-criteria map and put three questions to the vendor

Run a pilot on your own cases with traps

For an AI assistant, compile your own 20-30 questions with required, ideal and unacceptable criteria

t.me/prv_adv

A good tool is one whose correctness you can prove