In the last step of the setup, Activation and implementation, you record what remains to be done outside Cenedril and link the reporting office with the data protection management. The Implementation card bundles the work packages, the card Data protection of the reporting office brings the reporting channel’s processing activity into the record, and the Yearly review reminds you to repeat it.
Work through the implementation
Assign the work packages
In the setup overview open the step Activation and implementation. The Implementation card lists one block per work package with number, name, number of sub-steps and state. Choose the Implementation responsible and the Priority and click Create task for this work package. The task appears in the person’s task area with the sub-steps as a checklist.
Tick off the sub-steps
Expand a work package. Every sub-step is a card with a check box and an expandable implementation guide: legal reference, how it is implemented, sub-tasks, where and when, trigger and frequency. Tick off completed sub-steps here or in the task; the state comes from the task tool. The setup overview names in the row Activation and implementation how many packages are done.
Data protection of the reporting office
Link with the data protection management
In the card Data protection of the reporting office click Link to the data protection management and choose where you keep the record: in Cenedril’s data privacy wizard or in an external system. With the wizard, Cenedril reserves the activity in the record; Send request asks the responsible person from the data privacy wizard to add it.
Add the activity to the record
In the Record of Processing Activities of the data privacy wizard a notice says that the reporting office asks for the activity to be added. Create activity takes over the proposal, Link an existing activity compares an existing activity field by field. The activity then carries the reporting office’s badge, and the card in step 5 shows its state with Open in the record.
Add impact assessment and measures
The card states whether an Impact assessment has started and lists the row Assigned measures from the data privacy wizard; Go to the impact assessment and Go to the measures lead there. Under Measures of the module you find the safeguards the area implements itself, such as access for the reporting office alone, logging of every access and deletion after the period.
Yearly review
Set up the reminder
In the Yearly review card choose date, time and Recipients and click Set reminder (yearly). The reminder comes every year and leads back to this step so the reporting office reviews its setup and its measures.
Check the legal register
Open the register
Below the five steps of the overview is the row Legal register; Open legal register leads there. The register lists the duties of the German Whistleblower Protection Act (HinSchG) and of Directive (EU) 2019/1937. The German Act appears when the reporting office works under German law; for any other country the register lists the Directive. For each provision it names the addressee, such as Employer, Reporting office or Reporting person, the Places of fulfilment and the state.
Read the state
A place of fulfilment is a part of the setup: Whistleblower Protection Policy, Rules of Procedure of the Reporting Office, Applicability, Reporting office, Reporting channels, Case handling and Data protection. A duty is Covered once each of its places is in place. A click on the row shows how Cenedril covers the duty and, for each place, when it counts as in place, with Go to step. Provisions that bind only the state and authorities read Government only.
Close gaps
By place of fulfilment shows for each place the provisions it carries. The Gap Analysis lists open duties with the missing place. A click on the place leads to the step that fulfils it.
Result: The setup overview shows all work packages as done in the row Activation and implementation, the reporting office is linked with its activity in the record, the yearly review is set up as a reminder, and the legal register shows which duties the setup fulfils.