Reading lists by role

Each role below has a short reading list, in the order to read it. In a small company one person may hold several roles.

Privacy lead or Data Protection Officer#

Owns the decisions: the purposes and their legal basis, where each form is shown, when a version is published, rights requests, evidence and breaches.

Read	What you get from it
The DPDP Act at a glance	What the Act asks of a business, and where the product helps
Set up your first banner	An empty project taken to a working banner
Add purposes	Each purpose with its legal basis and the data it uses
Publish a version	How a draft reaches visitors
Handle a request	Rights requests carried out against their deadline
Record a breach	The breach register and the 72 hours for the Board report

Marketer#

Owns what visitors read and see: the wording of the banner, its languages and its look. Tell the privacy lead when a campaign needs a new purpose or a new partner.

Read	What you get from it
What is PIEDAP Consent	What the product does and what it leaves to you
Write the notice	The banner wording, in clear and plain language
Change the look	Colours and placement that fit the brand
Add a language	The form offered in one more language
Translate and approve a language	A draft translation, reviewed and approved by a person
Preview as a visitor	The banner as someone in another place sees it

Support agent#

Answers people. Looks up a person's consent when they call or write, and logs requests that arrive outside the hosted page. Carries out withdrawal or erasure when the privacy lead agrees.

Read	What you get from it
Find a person	Every record held for one identifier
Read a record	What the person agreed to, when and on which form
Ways people send a rights request	How requests reach the queue
Log a request	A request that came by email, phone or a support ticket, added to the queue
Handle a request	Access, erasure and withdrawal in one step
Withdraw consent or erase a person	The same actions without a request

Developer#

Connects the product to the site, the apps and the servers: installs the banner, makes tags wait for consent, records consent from the server and builds the webhook receivers.

Read	What you get from it
Put a banner on a test page	A working banner and a first test record
Install on a website	The script tag on every page
Hold tags until consent	Tags that wait until the visitor allows their purpose
Record consent from your server	Consent written with a secret key
Receive webhooks	Your systems stop using a person's data, delete it or email a confirmation link when the event arrives
Link to the hosted pages	A privacy notice, a rights request form and a consent page, served for you and linked from your site

Administrator#

Looks after the project: its settings, who can open it, the keys and the webhook addresses. Stores the daily evidence anchors in a system the company controls.

Read	What you get from it
Change project settings	The privacy contact, the request deadline and retention
Access and roles	Who can open a project and what they can do in it
Create a key	The key that connects a site, app or server
Request to go live	A test key turned into a live one
Manage webhook endpoints	The addresses that receive each event
Verify evidence anchors	Your own copy of each day's signed anchor

Operator#

Runs the service on your company's own infrastructure. Skip this list if the service is run for you.

Read	What you get from it
Deployment options	The ways the service can be run
Deploy with Docker Compose	A running deployment
Configuration	Every setting of the deployment
Back up and restore	What to back up and how to bring it back
Monitor a deployment	What to watch and which alerts to start with
Approve live keys	Requests to go live, reviewed and answered

Auditor#

Checks that consent was asked and recorded properly, and that nothing was changed afterwards.

Read	What you get from it
How consent is proven	The record, its sealed history, receipts and daily anchors
Receipts	What a signed receipt holds
Daily anchors	How one day's events are signed together
Verify a receipt	A receipt checked in the console
Read the audit log	Who changed what in the console, and when
DPDP duties for notice and consent	What the product does for each duty, and what stays with the business

Dashboard starters#

Each role opens the Overview on its own starter. Anyone can also choose any starter under New dashboard… or Reset to starter…, as Customise your dashboard shows.

Role	Starter	What it puts first
Owner	Owner	Consent in force, deadlines, breaches, overdue processor tasks and approvals waiting
Privacy officer	Privacy lead	Deadlines first: requests, expiring grants, breaches, processors and consent by law
Grievance officer	Grievance officer	Open, overdue and due-soon requests, the queue and how fast requests close
Content editor	Marketer	From banner view to full grant, by purpose, country, language and form
Developer	Developer	Is consent arriving, are webhooks delivered, and what loads before the answer
Auditor	Auditor	Sealed events, consent in force, deadlines met, breaches and the latest records
Significant Data Fiduciary	Significant Data Fiduciary	A year of rights deadlines, breaches, processor tasks and consent by law

Roles and access#

The reading lists above describe the work. The six project roles set what each person may do, and the server checks them on every action.

Fact	Detail
Where access is given	Per project, under People and roles
Roles	Owner, Privacy officer, Grievance officer, Content editor, Developer, Auditor
Before roles are turned on	Everyone who can open the project can do everything in it
Second-person approval	Erasure, exports, key reveals and audit log downloads can wait for a second person
What is recorded	Every change and every read of personal data, with who did it and when

See Access and roles.