GV004Roles and decision rights

The statement of which decisions the program may take, of the role entitled to take each, and of the person holding that role. The decisions are the ones the framework names elsewhere: to open a case on a person, to reach for the content of what they wrote, to withdraw their access before any finding, and to recommend a consequence.

Pillar: GV | Governance and mandate
Sources cited: 6
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
GV004/HRMandatory	Croatia	Zakon o radu, članci 29, 150, 151, and 153Hrvatski sabor · read 5 Oct 2026	That workers’ personal data are collected, processed, used, and transmitted only where a law provides or where needed for the rights and obligations of the employment, that the employer sets out in advance in the work rules which data and for what purpose, that an employer with at least twenty workers appoints a person trusted by the workers to oversee that processing, that the employer consults the works council before an important decision, the introduction of new technology among them, and that a decision on collecting, processing, using, and transmitting data on the worker, and on appointing the overseeing person, needs the works council’s prior consent, replaceable by a court or arbitration decision.	An employer with at least twenty workers appoints a person who enjoys the workers’ trust and is authorized, beside the employer, to oversee whether workers’ personal data are collected, processed, used, and transmitted in accordance with the law; the appointment needs the works council’s prior consent.
GV004/GRMandatory	Greece	Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026Νόμος 4990/2022, άρθρα 8, 9, and 10https://www.taxheaven.gr/law/4990/2022/arthro/9 · read 5 Oct 2026	For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, a qualified member of staff is designated Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.), with the resources, autonomy, and access to the management bodies to coordinate compliance, incident reporting, and continuity plans; the duties are incompatible with those of the Data Protection Officer. The Υπεύθυνος Παραλαβής και Παρακολούθησης Αναφορών (Υ.Π.Π.Α.) is an employee or a third party and reports directly to the top management body; other duties may not impair the independence of the role.
GV004/ITMandatory	Italy	Provvedimento del 17 aprile 2026, Framos ItaliaGarante per la protezione dei dati personali · read 29 Aug 2026	That a company mailbox left running after the employment ends is a processing needing a ground of its own, and that a smooth handover and the chance of wanting something later are not one.	The technician who reached into the accounts held the role and not the instruction. A signed confidentiality undertaking is not the documented instruction the Regulation asks of anyone processing on the controller’s behalf.
Recommended	United Kingdomwhere written	Insider Risk Practitioners and StakeholdersNPSA · read 29 Aug 2026Board Engagement and GovernanceNPSA · read 29 Aug 2026	That a program needs a senior stakeholder group drawn from named functions, and a director who carries the board’s strategy into policy.	One board member holds overall responsibility for protective security, and a non-executive director acts as an independent champion for it. Below them a director carries the strategy into policy, and senior staff in each business area answer for the risk assessment and for implementation in their own.