SERVICES › SAMPLES › MONTHLY DPO SUPPORT › C5
Policy and procedure change log

Part of the Monthly DPO support worked example for Quillmarrow Supplies Pte. Ltd. (fictional). Read it here in full or download the files.

Fictional organisation, illustrative only, not a client case study

« Back to the Monthly DPO support pack
Downloads
C5 · Policy and procedure change log
OrganisationQuillmarrow Supplies Pte. Ltd. (fictional)
DocumentC5 · Policy and procedure change log
Version1.0
Date5 February 2027 (illustrative)
Prepared byAlex Lew, reviewer and sign-off
Client approver (role)Head of Operations (DPO)
LabelFictional organisation, illustrative only, not a client case study

1. Why keep this log

This log provides one place to see what changed in Quillmarrow’s data protection policies and procedures, why it changed, who approved it and how staff were told. It gives the DPO an approval history to show management, and helps the DPO respond to supplier questionnaires by identifying the current documents and their approval history.

The table following this introduction records changes PC-01 to PC-10 for November 2026 to January 2027. It should be read alongside the underlying documents and the action tracker in C2. An entry in the log points to a change; the approved document and its supporting record remain the evidence of what was agreed.

2. Rules

  • Record each change against the document ID and version. Use version numbers to distinguish the approved document from earlier and draft versions.
  • Obtain approval from the person responsible for that document, as set out in B16. No change is live until it has been approved.
  • Record how staff were told, such as through a Teams post or team briefing, or mark the entry “none needed” where no communication is required.
  • Keep superseded versions under B8 so the organisation can trace what was in place before a change.
  • Record the reason for the change and any exceptions or outstanding decisions. The DPO maintains the log; document owners remain responsible for their own documents.

3. Summary of the quarter

The log records 10 changes. The MD approved 4, the DPO approved 4, the Head of Marketing approved 1 and the COO approved 1.

B8 v1.1 was approved on 18 December 2026, except for RS-02, RS-12 and RS-13, which were pending accountant and lawyer advice. Advice was received on 20 January 2027; the MD’s decision was on the agenda for 12 February 2027. The exception should remain visible in the January record rather than being treated as already resolved.

The log follows.

Change log (PC-01 to PC-10)

IDDateDocumentVersionChangeReasonApproverStaff communicationNext review
PC-0113 Nov 2026B11 Breach management planv1.0The breach management plan from the handover pack was adopted and issued to the incident team.Addressed G-10 by establishing the incident record and separate decision log.MDTeams post to relevant staff, 13 Nov 2026After the January 2027 drill; v1.1 in progress under DA-14
PC-0213 Nov 2026B4 Website privacy noticev1.1The updated website privacy notice was published.Addressed G-04 and the notice actions recorded in B2.DPOTeams post to relevant staff, 13 Nov 2026November 2027
PC-0320 Nov 2026B5 Data protection policyv1.0The data protection policy was approved.Addressed G-01 by documenting the programme policy.MDTeam briefing, 20 Nov 2026November 2027
PC-0420 Nov 2026B12 Do Not Call procedurev1.0The DNC procedure was approved.Addressed G-11 and established the process for the planned telemarketing campaign.Head of MarketingTeam briefing, 20 Nov 2026November 2027
PC-0527 Nov 2026B5 Data protection policy, annex Av1.0 to v1.1The complaints process was added as annex A.Addressed the complaints-process action under G-01.DPOTeams post to relevant staff, 27 Nov 2026November 2027
PC-069 Dec 2026B4 Job-application, showroom sign-up and CCTV noticesv1.1B4 v1.1 brings together the job-application notice (in use from 20 Nov 2026) and the showroom sign-up notice (from 2 Dec 2026), and adds the CCTV signage installed on 9 Dec 2026.Closed G-04 on 9 Dec 2026, within the revised date of 11 Dec 2026 agreed by the COO.DPOTeam briefing, 9 Dec 2026December 2027
PC-0710 Dec 2026B5 Data protection policy, annex Bv1.1 to v1.2The CCTV purpose and access statement was added as annex B; use for staff matters requires prior review by the DPO and HR Manager.Addressed G-03 and set a review route for use of CCTV in staff matters.MDTeams post to relevant staff, 10 Dec 2026December 2027
PC-0818 Dec 2026B8 Retention schedulev1.1The MD approved the retention schedule except for RS-02, RS-12 and RS-13, which remain awaiting confirmation.Addressed G-08; the three outstanding retention decisions are tracked in DA-08.MDTeams post to relevant staff, 18 Dec 2026When the MD decides RS-02, RS-12 and RS-13 (DA-08)
PC-0913 Jan 2027B7 Access and correction procedurev1.0 to v1.1The procedure was updated to require partner request forwarding within one working day and shared mailboxes to forward request-like emails to the DPO.Followed the AR-06 forwarding delay (DA-05) and the AR-13 late acknowledgement.DPOTeams post to relevant staff, 13 Jan 2027January 2028
PC-1020 Jan 2027B9 Vendor and data-intermediary checklistv1.0 to v1.1The DV-04 record and its pilot conditions were added.Recorded the vendor review and conditional pilot decision for DV-04; conditions are tracked in DA-13.COOTeam briefing, 20 Jan 2027Before the DV-04 pilot starts (DA-13)

Review and sign-off

Step Who Date
Log entries checked against the approved documents Head of Operations (DPO) 31 January 2027
Log reviewed at the January check-in DPO and COO, with the reviewer 5 February 2027
Log approved as the record for the quarter Head of Operations (DPO) 5 February 2027

Version history: v1.0 covers PC-01 to PC-10, November 2026 to January 2027. New entries are added as changes are approved; the log is not rewritten.

Expected next entries: B11 v1.1 (for MD approval at the 12 February 2027 quarterly meeting) and B8 v1.2 (once the MD decides DA-08). Each will be logged with its approver and how staff were told once it is issued.

IDs used: PC- is a change entry; B-numbers are the October 2026 programme documents (for example B5 data protection policy, B7 access procedure, B8 retention schedule, B11 breach response plan); DA- links to the shared action tracker (C2).

About this sample

Fictional organisation, illustrative only, not a client case study. Quillmarrow Supplies Pte. Ltd., its people, vendors, findings and dates are invented. Nothing in this document reports a client result.

I personally review and sign off every deliverable. You appoint your own DPO. I support them.

This is practical compliance support, not legal advice. For legal advice, use a Singapore-qualified lawyer.

What's not included

  • Acting as, being named as or replacing your DPO.
  • Legal advice, legal representation or submitting regulatory notifications on your behalf.
  • Certification or a guarantee of compliance.
  • An emergency hotline or a substitute for your own incident-response arrangements.
  • Forensic investigation, penetration testing, security engineering or administering your systems.
  • Holding your customer database or making changes to live systems.
  • Rebuilding the whole PDPA programme, a new AI governance review or a major new project (these need a separate scope and quote).
  • Healthcare-sector work or on-site delivery.

Questions about this sample: DM @alewyl1 on X, or ask for a free intro call (coffee chat).
Next

« All items in the pack  |  About Monthly DPO support  |  DM @alewyl1 on X, or ask for a free intro call (coffee chat).