SERVICES › SAMPLES › MONTHLY DPO SUPPORT
Monthly DPO support: full worked example

Monthly DPO support is an add-on for organisations that have appointed their own DPO. You appoint your own DPO. I support them. This worked example shows three months of the service for one invented company, Quillmarrow Supplies Pte. Ltd. (fictional), after its PDPA programme handover: a monthly check-in report, the shared action tracker, the request log, a new-vendor review, the change log, a staff refresher, a breach drill and the quarterly report to management. The DPO and management make every decision; the reviewer supports them.

Fictional organisation, illustrative only, not a client case study

« All sample previews  |  About Monthly DPO support  |  The PDPA programme that came before
The situation

Quillmarrow Supplies Pte. Ltd. (fictional) is an office-supplies distributor with about 80 staff, a Singapore showroom and warehouse, a web shop and trade accounts. In October 2026 it completed a PDPA programme (the B1 to B16 pack). Its Head of Operations, the appointed Data Protection Officer (DPO), accepted the handover on 2 November 2026 and the Managing Director (MD) acknowledged it the same day.

This pack shows the three months that followed: November 2026, December 2026 and January 2027. The DPO ran the programme. Management made the decisions. The reviewer supported the DPO with a monthly check-in, reviews of drafts and records, and a quarterly report to management. All dates are illustrative.

You appoint your own DPO. I support them. In this pack, every decision and approval is recorded against a Quillmarrow role. The reviewer is never the DPO, is never named as the DPO and does not submit notifications.
Decisions this supports

The pack helps the DPO and management answer five recurring questions. The table shows where each one is answered and which Quillmarrow role decides.

Where each decision is answered

Decision Answered in Decided by (role)
Requests, complaints and process changes C3 request and complaint log; C5 change log DPO; document approvers as listed in C5
Adding a vendor, system or data use C4 vendor review record (DV-04) DPO decides; COO approves
Open actions needing management attention C2 shared action tracker; C8 quarterly report MD and COO
What to escalate, and to whom C1 monthly report; C8 quarterly report DPO escalates to the COO or MD
Suspected breaches C7 breach drill record; INC-2026-11 in the December monthly report (C1) MD and DPO (notification decision)
The quarter at a glance
Measure What the pack records
Review areas (from B2) At handover: 3 Red, 6 Amber, 1 Green/Amber, 1 Green. At 31 January 2027: 8 Green, 3 Amber (G-02, G-08, G-09), none Red
Shared actions 15 (DA-01 to DA-15): 8 closed, 1 in progress, 4 open, 2 overdue
Requests and complaints 8 (AR-07 to AR-14): 7 closed within Quillmarrow's own response target in B7, 1 open within that target, 1 acknowledgement late
Incidents 1 (INC-2026-11, 10 December 2026: a statement of account emailed to the wrong B2B customer; deleted by the recipient the same day). The DPO completed the assessment on 11 December 2026; the MD and DPO then recorded a separate decision that it was not notifiable, so no PDPC notification was made
Vendor changes 1 new vendor reviewed (DV-04, evening and weekend customer support). The DPO decided on 18 January 2027 to allow a pilot only if the DA-13 conditions are met; the COO approved on 20 January 2027
Policy and procedure changes 10 (PC-01 to PC-10), each with an approver and a staff communication
Staff Briefing in December (74 of 80); refresher on 26 January 2027 (71 of 79)
Breach drill Tabletop on 21 January 2027 against B11; four lessons, one action (DA-14)

These are counts of what the sample documents contain. They are not results or outcomes.

How to read the RAG ratings. The ratings show progress against the B2 action plan. Green means the planned actions for that area are done and evidenced; it is not a statement that Quillmarrow is compliant.
Everything in the pack
RefItem (read online)PDF pagesClient approverDownloads
C0Monthly DPO support pack: cover, contents and how to read it6Managing Director (approves the final pack)PDF · DOCX
C1Monthly DPO check-in report: December 20265Head of Operations (DPO)PDF · DOCX
C2Shared action tracker6Head of Operations (DPO)XLSX · PDF · DOCX
C3Request and complaint log5Head of Operations (DPO)XLSX · PDF · DOCX
C4Vendor review record: DV-044Head of Operations (DPO) decides; COO approvesPDF · DOCX
C5Policy and procedure change log4Head of Operations (DPO)XLSX · PDF · DOCX
C6Staff refresher: session outline and attendance4Head of Operations (DPO) with the HR ManagerXLSX · PDF · DOCX
C7Breach drill record4Head of Operations (DPO)PDF · DOCX
C8Quarterly data protection report to management5Managing DirectorPDF · DOCX

Download the whole pack as a ZIP

Every file carries the label "Fictional organisation, illustrative only, not a client case study", a version, a date, the preparer and the client approver role. All dates are illustrative.
How to read it
Breach facts

The breach rule used in this pack. A breach is notifiable if it is likely to cause significant harm to the people affected, or affects 500 or more people. If it is notifiable, tell the PDPC as soon as practicable and no later than 3 calendar days after assessing that it is notifiable. The assessment is recorded separately from the decision to notify. The FAQ explains the triggers and deadlines.
About this worked example

Prepared by Alex Lew (CFA, AIGP, CIPP/A, FIP). I personally review and sign off every deliverable.

The templates behind these documents are in the AI governance and PDPA toolkit: complete and available now; one organisation, internal use, 12 months of updates. DM @alewyl1 on X, pay, then the ZIP arrives by email.

This is practical compliance support, not legal advice. For legal advice, use a Singapore-qualified lawyer. You appoint your own DPO. I support them.

Want this for your business? DM @alewyl1 on X, or ask for a free intro call (coffee chat).