# Training — Privacy Operators

> Privacy operators run DSAR (export, delete, access), consent management,
> retention, residency, and the privacy-incident first response. They are the
> operational arm of the privacy program.

## Audience and prerequisites

- Audience: compliance and privacy staff plus on-call privacy operators.
- Prerequisites: legal-privacy foundations, GDPR/CCPA/regional jurisdictions
  module, RBAC current, evidence-preservation training.
- Refresh cadence: 6 months; per-regulator update mandatory micro-brief.

## Learning objectives

By certification, a privacy operator can independently:

1. Process a DSAR end-to-end: identity verification, scope confirmation, export,
   delivery, audit, follow-up.
2. Process a deletion request: scope, dependencies, retention exceptions
   (legal-hold), verification.
3. Manage consent: capture, withdrawal, propagation across caches and downstream
   jobs, audit.
4. Apply retention policy per data class and residency; recognize and resolve
   retention violations.
5. Run the first response on a privacy incident per
   `docs/runbooks/privacy-incident.md`, including evidence preservation and
   notification scope.
6. Coordinate with legal, security, and tenant administrators for B2B-contract
   privacy obligations.

## Curriculum modules

| #   | Module                                                     | Duration | Format                          | Assessment                                 |
| --- | ---------------------------------------------------------- | -------- | ------------------------------- | ------------------------------------------ |
| 1   | DSAR end-to-end (export, delete, access)                   | 180 min  | hands-on against staging        | 3-DSAR drill (one of each)                 |
| 2   | Consent capture and withdrawal propagation                 | 120 min  | hands-on with consent tooling   | 5-consent drill                            |
| 3   | Retention policy and residency                             | 120 min  | seminar + class-by-class cards  | 20-item retention/residency test (≥ 18/20) |
| 4   | Privacy-incident first response (joint with runbook owner) | 120 min  | scenario rehearsal              | runbook walkthrough pass                   |
| 5   | Evidence preservation and audit-grade records              | 90 min   | guided + peer review            | rubric pass on 5 audit packets             |
| 6   | Regulator notification and subject notification            | 120 min  | drafting workshop with legal    | 2-notification drill (regulator + subject) |
| 7   | Tenant and B2B privacy contracts                           | 60 min   | walkthrough of contract clauses | 3-clause interpretation drill              |
| 8   | Cross-system privacy: assistant, memory, evidence, billing | 90 min   | hands-on across subsystems      | per-subsystem privacy-mapping pass         |

## DSAR end-to-end protocol

1. **Receive** the DSAR (web form, message-center, email).
2. **Verify identity** using the canonical verification flow; for
   special-category data (minors, biometrics, health), elevate to an
   identity-verification supervisor.
3. **Confirm scope**: residency, data classes, time window. Capture as a
   structured impact-scope record.
4. **Run the request**:
   - Export: enqueue the export job; the inner provenance manifest is generated
     by the provenance pipeline.
   - Deletion: enqueue against the documented predicate; preserve legal-hold
     rows; record verification.
   - Access: enqueue the access summary; deliver under TLS to the verified
     channel.
5. **Deliver** to the subject through the documented channel; capture delivery
   audit.
6. **Audit close-out**: confirm every downstream cache, queue, and index has
   been propagated against; close the case in the privacy registry.

## Consent management protocol

- Consent is captured per data class with the canonical purpose statement; the
  customer sees the disclosure copy from the i18n catalog.
- Withdrawal must propagate to every cache, every downstream job, and every
  analytics emission within the documented SLA (24 h max).
- Special-category consent (minors, biometrics, health) is treated as high-risk;
  withdrawal triggers immediate processing-halt and audit ping.

## Retention and residency protocol

- Every data class has a published retention period and a residency region.
- Retention violations (data kept beyond policy) are sev2 incidents.
- Residency violations (data processed in a forbidden region) are sev1
  incidents; route to the privacy-incident runbook.
- Vendor sub-processor retention is reviewed quarterly; vendor-incident packets
  are evaluated for residency exposure.

## Scenario rehearsal

1. **Cross-tenant DSAR**: a DSAR is submitted by a tenant administrator for
   their tenant's data; operator scopes against tenant boundary, runs the
   export, verifies no cross-tenant data is exposed.
2. **Deletion with legal-hold conflict**: a deletion request conflicts with an
   active legal-hold; operator pauses deletion, captures the hold, communicates
   with the subject under the legal-reviewed template.
3. **Consent withdrawal during active assistant session**: a customer withdraws
   memory consent mid-session; operator force-flushes consent cache, observes
   the assistant fall to memory-off mode, captures the audit.
4. **Privacy incident first response**: a cross-tenant memory write is detected;
   operator preserves evidence, freezes affected exports and deletions, hands
   off to the privacy-incident runbook commander.
5. **Regulator notification under Article 33**: a sev1 incident requires a
   regulator notification within 72 h; operator drafts the notification,
   captures legal review, delivers via the documented channel.

## Certification criteria

- All 8 modules complete with passing assessment.
- All 5 scenarios passed.
- Operator has shadowed 5 DSARs end-to-end with a certified privacy operator.
- Operator has co-led 1 privacy-incident drill end-to-end.
- Privacy lead and legal counsel sign-off.

## Tabletop drills

- Per-regulator update: mandatory micro-brief on the change.
- Quarterly: DSAR-under-load drill alongside support.
- Semiannually: privacy-incident tabletop with security and compliance.

## Owner

Privacy lead owns this training. Legal counsel, security lead, and compliance
lead co-review. Updates require all four sign-offs for regulator-touching
modules.