Organisation	Quillmarrow Supplies Pte. Ltd. (fictional)
Document	B1 · Programme scope sheet
Version	1.0
Date	30 October 2026 (illustrative)
Prepared by	Alex Lew, reviewer and sign-off
Client approver (role)	Chief Operating Officer
Label	Fictional organisation, illustrative only, not a client case study

1. Objectives

This engagement supports Quillmarrow’s management and appointed Data Protection Officer (DPO) in establishing a practical approach to personal data protection. The reviewer will prepare the programme documents and handover for Quillmarrow’s review and approval. Quillmarrow remains responsible for its decisions, implementation and ongoing operation.

The programme responds to:

• An enterprise customer’s request for a privacy policy, breach plan and retention schedule.
• The SharePoint near-miss involving customer records shared through an “anyone with the link” setting.
• A planned telemarketing campaign to SME owners.
• The newly appointed DPO’s need for a working handover.
• Staff use of ChatGPT and Copilot, noting that a detailed AI review is a separate engagement.

The work is intended to support six management decisions:

1. Data and purpose: what personal data Quillmarrow needs, why it is collected, where it is held and where it goes.
2. Priorities and ownership: which gaps need attention first, who owns each action and what evidence will show progress.
3. Individual requests: what staff should do when someone withdraws consent, requests access or correction, or makes a complaint.
4. Vendors and transfers: what to check before appointing a vendor or transferring personal data overseas.
5. Breach response: how staff escalate a suspected breach, assess the facts and record the separate notification decision.
6. Approval and upkeep: what management and the appointed DPO need to approve, communicate, review and maintain after handover.

The programme will identify evidence gaps and proposed actions. It will not establish that Quillmarrow is compliant. Questions of law and legal effect should be confirmed with a Singapore-qualified lawyer.

2. In scope

Review areas

The reviewer will assess the following areas using the information made available by Quillmarrow.

ID	Review area	Illustrative focus
G-01	Accountability	DPO appointment and contact, policy, complaints process and staff communication
G-02	Consent	Collection and recording of consent, including marketing choices and withdrawal
G-03	Purpose limitation	Stated purposes and uses, including CCTV
G-04	Notification	Privacy notices at relevant collection points
G-05	Access and correction	Request handling, escalation, response and records
G-06	Accuracy	Processes for checking and updating relevant records
G-07	Protection	Access, sharing and administrator controls, based on descriptions and masked evidence
G-08	Retention limitation	Retention decisions, ownership and disposal arrangements
G-09	Transfer limitation	Vendor information and overseas-transfer safeguards, including DV-01 and DV-02
G-10	Data breach notification	Escalation, assessment, decision records and the breach plan
G-11	Do Not Call provisions	Planned telemarketing, register-check process and sender details

Collection points in scope include the web-shop checkout, job-application form, showroom sign-up, CCTV and telemarketing. The inventory also covers relevant staff, supplier and customer processes described in B3. Findings will distinguish information reported by Quillmarrow from evidence actually provided.

Deliverables

The intended pack comprises B1 to B16. Names marked to confirm are provisional scope descriptions: the source list supplied for this scope sheet does not establish the final titles or allocation of every document. The DPO and reviewer should confirm those titles before the pack index is finalised.

ID	Deliverable	Intended output
B1	Engagement scope sheet	Objectives, boundaries, inputs, timetable and acceptance
B2	Gap review and action tracker	G-01 to G-11, priorities, owners, evidence and next actions
B3	Personal data inventory	PD-01 to PD-25, purposes, systems, flows and open questions
B4	Data protection policy — title to confirm	Proposed policy for management review and approval
B5	Privacy notices — title to confirm	Proposed notices for relevant collection points
B6	Consent and withdrawal procedure — title to confirm	Proposed staff process and records for consent choices
B7	Access and correction request log	Illustrative AR-01 to AR-06 and request-handling records
B8	Retention schedule	RS-01 to RS-20, with decisions and evidence to confirm
B9	Vendor due-diligence questionnaire	Questions and evidence gaps for DV-01 to DV-03
B10	Vendor and overseas-transfer checklist — title to confirm	Proposed checks for supplier appointment and transfer decisions
B11	Data breach management plan and playbook	Response roles, C.A.R.E. sequence, assessment and decision records
B12	Staff awareness materials — title to confirm	Proposed staff guidance for relevant day-to-day actions
B13	DPO handover and maintenance checklist — title to confirm	Proposed ownership, routine reviews and open actions
B14	AI use and personal data considerations — title to confirm	Limited signposting only; not a detailed AI governance review
B15	Breach scenario and worked example	Illustrative INC-2026-07 assessment and decision records
B16	Management briefing and final handover — title to confirm	Proposed summary of decisions, open actions and ownership

The final contents of any item marked “to confirm” remain subject to agreement. Other vendors named in the inventory are in scope for the checklist, but the sample vendor questionnaire is completed only for DV-01 to DV-03. A schedule, checklist or draft is not evidence that a control has been implemented or tested.

3. Out of scope

The following are excluded:

• Acting as your DPO. Quillmarrow appoints its own DPO; the reviewer prepares the handover and can support them separately.
• Legal advice, legal contract drafting, representation or a guarantee of compliance. Quillmarrow should obtain advice from a Singapore-qualified lawyer where the law matters.
• Forensic investigation, penetration testing, security engineering or implementing changes in live systems.
• A detailed AI governance review or ISO/IEC 42001 readiness check unless separately scoped. Any ISO/IEC 42001 work is a readiness check, not certification.
• Ongoing document upkeep after handover unless agreed through Monthly DPO support.
• Healthcare-sector work or on-site delivery.

The reviewer may identify questions for management, IT, a supplier or legal counsel. That does not include resolving those questions through a separate investigation, drafting legal clauses or making changes to a live service.

4. What we need from you

Quillmarrow should nominate a named engagement contact and confirm the Head of Operations as its appointed DPO for day-to-day coordination. The reviewer also needs access to the MD as approver, the COO as sponsor and the relevant process owners for interviews, review and decisions.

Please provide, as available:

• A list of systems, vendors, relevant entities and collection points, with an owner for each.
• Existing privacy notices, policies, procedures, forms and staff guidance, including the website statement and materials used at the showroom.
• Descriptions of what data is collected, why it is used, who can access it, where it is stored and with whom it is shared.
• Available contract information and relevant supplier responses, including the DV-01 arrangements and DV-02 hosting-region question.
• Current descriptions or masked screenshots of sharing, access and retention settings.
• The existing breach-related email record and available evidence for INC-2026-07, appropriately masked.
• Existing request-handling and retention information, including known gaps and decisions awaiting management input.

No customer database is requested or to be received. Provide descriptions and de-identified samples only; mask personal data in screenshots and documents before sharing. Do not put client personal data into AI drafting tools. If an item cannot be supplied, identify it as unavailable so the reviewer can record the resulting limitation.

The DPO should coordinate responses and identify a substitute process owner when someone is unavailable. Management remains responsible for the accuracy and completeness of information it supplies.

5. Timeline

The programme is expected to run over about three to four weeks, subject to timely inputs, access to role holders and management decisions. The fourth week can be used where needed for briefing, handover and approvals.

Week	Planned activity	Dependencies
1	Discovery calls; gather existing documents; map systems and collection points; develop B3 inventory.	Named contact and DPO; process-owner availability; system and vendor lists; de-identified inputs.
2	Review G-01 to G-11; prepare B2 gap priorities and initial drafts.	Sufficient process descriptions and existing notices, policies and contract information; clarification of missing evidence.
3	Develop procedures, B8 retention proposals, B11 breach plan and notices; review relevant vendor questions.	DPO and process-owner feedback; management direction on open choices; supplier information where available.
4	Management briefing, final revisions, DPO handover and approvals.	Consolidated feedback; MD and DPO availability; decisions on outstanding actions and provisional deliverable titles.

The reviewer will identify dependencies and open questions as they arise. A delayed supplier answer or management decision may remain an explicitly open item rather than being filled with an assumption.

6. Review rounds

The engagement includes a set number agreed in the quote.

The DPO should coordinate one consolidated set of feedback for each review round, resolve conflicting comments with the relevant owners and identify the person authorised to make each decision. Comments should distinguish factual corrections, requested drafting changes and decisions still awaiting approval.

The reviewer will address feedback within the agreed scope and record material points that remain unresolved. Additional rounds or work arising from a scope change are subject to a separate quote before that work proceeds.

7. Acceptance

A deliverable is ready for acceptance when:

1. Its agreed purpose and scope have been addressed, subject to identified evidence limitations.
2. Quillmarrow’s factual comments have been considered and material open questions are visible.
3. Proposed actions identify an owner, target date and evidence where practical.
4. The reviewer has personally reviewed and signed off the deliverable for handover.
5. The appropriate Quillmarrow approver has recorded acceptance or identified an outstanding decision.

The DPO reviews the pack for operational usability and ownership. The MD approves the data protection policy, B11 breach management plan and final pack. The DPO confirms the handover and ongoing ownership; acceptance of an individual working document does not replace an MD approval required for the final pack.

Acceptance means Quillmarrow has reviewed the deliverable for its agreed purpose and recorded any open items. It does not mean that recommendations have been implemented, controls have been independently tested or a legal conclusion has been reached. The DPO should transfer outstanding actions to B2 with their owners and target dates.

8. Pricing factors and scope changes

The quote reflects the scope and information available when it is prepared. Factors that can affect it include:

• The number of systems, vendors and entities.
• The number of collection points and languages.
• The state, availability and quality of existing documents.
• Unresolved supplier questions and the work needed to identify or follow them up.
• The speed of review, consolidated feedback and management decisions.

If the work requested changes, the reviewer will describe the proposed change and quote it before work proceeds. Examples include additional entities, collection points, languages or a separately scoped detailed AI governance review.

9. Working method

The engagement is fully remote, using video calls and shared documents. Fieldwork consists of interviews with role holders, document review, and system walk-throughs using descriptions and screenshots with personal data masked. No customer database is received.

AI may help with drafting, but client personal data stays out of AI drafting. The reviewer personally reviews and signs off every deliverable. Quillmarrow’s DPO and management then review and approve the documents as set out above.

For questions, contact the reviewer by X DM to @alewyl1. A free introductory call, described as a coffee chat, is also available.

10. Sign-off

By signing, the parties confirm their review of this scope sheet and record any agreed changes separately.

Role	Sign-off	Date
Managing Director, Quillmarrow		To be entered on approval
Head of Operations, appointed DPO, Quillmarrow		To be entered on approval
Reviewer		To be entered on sign-off