Assigning Responsibility to Groups Instead of Individuals

How it works today in most organizations

In most organizations, responsibility means a name. The review reminder for the data processing agreement (DPA) with the payroll provider sits with Ms. Becker in HR. The task "Review the ERP authorization concept" sits with Mr. Yilmaz in IT operations. The access request from a former applicant was taken by the data protection coordinator because she happened to be at her desk. And the risk "External service provider access to the ticket system" has a risk owner who entered it two years ago.

That works as long as everyone is around. In day-to-day work, they are not. Ms. Becker is on vacation for three weeks, and the reminder about the contract lands in an inbox nobody reads. Mr. Yilmaz is out sick, and the task stays open with a due date of "yesterday", although two colleagues could finish it in an hour. Nobody sees it, because it is not assigned to them.

Many organizations work around this with a shared mailbox. Requests go to "privacy@", notifications too, and four people read along. That solves the reachability problem and creates a new one: who answered the request? Who decided to extend the deadline? The mailbox only shows that "privacy@" replied. The documentation still lists the person who set up the mailbox as responsible.

The third workaround is the handover list. When someone leaves the organization, a file like "Handover_Becker_final.docx" appears with everything that person was responsible for. It is rarely complete, because nobody knows by heart in which review reminders, erasure rules and risk assessments their own name appears.

Information security looks no different. The measure "Document patch management for servers" is assigned to one administrator, and the rest of IT operations only hears about it in the team meeting. Anyone checking the calendar finds a recurring reminder in the predecessor's inbox that has gone nowhere since he moved to development. Each of these workarounds is reasonable on its own. Together they produce documentation that knows names but no teams.

The moment it becomes apparent

This almost always shows up with a staff change. The data protection coordinator resigns, her account is deactivated, and suddenly dozens of entries have no one responsible. Or it shows up in an audit: the auditor asks who owns the open measure from the last report, and the answer is "the colleague who is no longer with us".

In both cases the work was never tied to one person. Only the entry was. The task belonged to a team from the start, and that team did not appear in the documentation. That team is exactly what most tools cannot name as responsible.

The target process in six steps

A sound responsibility model separates two questions that today collapse into one name: which team is responsible for a topic, and who currently belongs to that team? These six steps describe the process, regardless of the tool.

1. Define responsibility by function. The starting point is not the staff list but the question of which functions actually work on data protection and information security: for example a data protection team, IT operations, HR and information security. Each function becomes a group.

2. Create groups and maintain their members. Each group gets a name, a short description and its members. In preeco | data protection and preeco | information security, which share one platform, administrators create these responsibility groups in the settings under users and permissions. With several companies, each group also gets its assignment to organizations.

3. Assign groups where a team is responsible. In the "Assigned to" field, responsibility groups appear next to individual users, and both can be combined: the group "HR" plus the data protection coordinator. This applies to tasks as well as review reminders, requests, erasure rules, risks, ISMS requirements and responsibilities in business processes.

4. Notify every member. When a group is assigned, every member receives the email notification, and the group's tasks appear on the dashboard under "My tasks". Whoever has time first takes it on. Whoever is on vacation is no longer the only recipient.

5. Work traceably. The group does not replace a log. On the document, the activities record who actually worked on a task or request. That keeps the evidence a shared mailbox cannot provide.

6. Handle joiners and leavers through membership. Whoever joins the team becomes a member and is immediately responsible for all of the group's entries. Whoever is deactivated or loses access automatically leaves every responsibility group. And when a group itself is deleted, the system asks for a successor who takes over all of its assignments.

When a person remains the better choice

Groups do not replace personal accountability. A risk owner who makes a treatment decision, or a data protection officer who issues an opinion, should stay entered by name. Groups belong where the work is shared: recurring reviews, incoming requests, review reminders for contracts and retention periods.

The combination of both has proven itself. The group ensures that an entry is never orphaned; the person entered alongside it ensures that a specific contact can be named in the audit.

Before and after in direct comparison

What the switch means in practice

The switch is less a technical than an organizational task. The groups are set up in a few minutes. The actual work lies in clarifying which function is responsible for which topic, and in deciding which existing entries move from a person to a group.

A practical approach: start with the entries that cause the most damage during an absence, meaning incoming requests, review reminders for contracts and recurring review tasks. Switch existing entries the next time they are edited instead of rebuilding everything in one day.

Also agree on the groups with the heads of department. Whoever becomes a member will receive notifications about tasks they did not see before, and should know why.

Three mistakes that make the switch unnecessarily hard

Creating one group for everyone. A group "All employees" notifies everyone and makes nobody responsible. Groups work when they are small enough for the members to coordinate among themselves.

Planning groups without a deputy. A group with a single member is a person under another name. When the last member leaves, the group is dissolved and its assignments are left empty. Plan for at least two members per group.

Abolishing personal accountability. Where a decision is made and signed, a name still belongs. The group complements the person; it does not replace them.

How to tell that it is time

Person-bound responsibility is not a problem in small teams. It becomes a risk when one of these points applies:

• Deadlines have already expired during a vacation.
• Requests arrive through a shared mailbox that several people read.
• The last staff change came with a handover list.
• You cannot say offhand where the name of a former employee is still entered.
• Data protection and information security share tasks across several departments.

If two or more of these apply, your documentation is tied to people while the work is tied to teams.