1. How the tracker works

This is the single shared list of actions arising from the data protection programme and monthly DPO check-ins. It brings together the actions, their owners, original and revised dates, status, evidence and any decisions needed. It should be read alongside the monthly check-in reports in C1 and the quarterly management report in C8.

The Head of Operations, as Quillmarrow’s appointed DPO, owns the tracker and reviews it at each monthly check-in. Each action owner updates the status and progress for their own action, including any delay, decision needed or evidence available. The reviewer supports the DPO by reviewing records and recording advice; the reviewer does not approve or close actions for Quillmarrow.

The original due date remains visible throughout an action’s life. A revised date requires COO agreement and is shown next to the original date so that a change does not obscure lateness against the original target. The tracker identifies who agreed the revised date. Where that information is missing, it should be confirmed rather than assumed.

An action is Closed only when the evidence of completion has been filed. A reported completion, a draft document or an intention to complete the work is not enough on its own. Actions that depend on management decisions remain visible until the relevant decision and required follow-up are recorded.

2. Status at 31 January 2027

The two overdue actions are DA-08, concerning retention decisions for RS-02, RS-12 and RS-13, and DA-10, concerning the unsigned DV-01 data protection addendum. The three decisions needed are the treatment of the older showroom sign-ups (DA-03), the outstanding retention positions (DA-08) and the next step for DV-01 (DA-10). These matters go to the management meeting on 12 February 2027, as set out in C8. Until then, the older sign-ups remain suppressed from marketing and the DV-01 interim data-minimisation measure remains in place.

3. Rules for closing an action

• The owner confirms that the action described in the tracker has been completed, including any conditions attached to it.
• The owner files the supporting evidence and records enough detail in the tracker for the DPO to locate it.
• The DPO reviews the completion and evidence before the status is changed to Closed.
• The closure date and any lateness against the original or revised date remain visible.
• Where a decision has been made but implementation is still required, record the decision and keep the implementation work visible.

The full tracker follows.

Tracker, part 1: actions, owners and dates

Tracker, part 2: evidence, decisions and latest update

Review and sign-off

Version history: v1.0, status at 31 January 2027, issued 5 February 2027. The tracker is updated before every monthly check-in; earlier snapshots are kept under B8.

Next update: before the March check-in on 5 March 2027, adding the decisions taken at the 12 February 2027 quarterly meeting and the follow-up they need.