How to Structure Data Governance and Privacy at a Telecommunications Operator

A model connecting data, responsibilities, and controls

At a telecommunications operator, personal information can move through very different systems and processes, from contracting and customer service to billing and supplier management. Governing it is not just a matter of choosing security tools. It requires defining who makes decisions about each processing activity, why the data is used, how long it is retained, and which controls must apply at each stage.

Data governance provides this framework: it combines policies, roles, processes, and controls to ensure that information is reliable, has a defined use, and is managed securely. For personal data, this model must align with the applicable obligations, including the General Data Protection Regulation (GDPR). In Spain, national data protection legislation must also be considered. The specific rules depend on the company’s activities, processing operations, and the territories in which it operates.

1. Inventory processing activities before setting controls

The first step is to build a traceable overview of personal data: what information is collected, where it comes from, why it is used, where it is stored, who can access it, and with whom it is shared. The inventory should also reflect the systems involved, the flows between departments and suppliers, and the retention periods or criteria.

At a telecommunications operator, it is useful to review customer processes and avoid limiting the analysis to a single database. A single commercial relationship may involve contracting, support, billing, and incident management tools. Mapping the entire journey helps identify duplication, access that is not appropriate to a role, and transfers that need review.

Based on the inventory, the company can classify information according to its sensitivity, purpose, and protection needs. The classification should guide decisions about measures and permissions, not expand data collection: the principle of data minimization requires limiting data to what is necessary for each purpose.

2. Assign responsibilities and separate roles

Governance requires identifiable people responsible for it. Management should support the framework and resolve priorities; business teams should justify their uses of data; technology and security teams should implement and maintain controls; and privacy, data protection, and legal functions should take part in assessing the obligations and risks within their remit.

It is also necessary to clarify who acts as the controller and when processors are involved, such as suppliers processing information on the operator’s behalf. The contractual label alone does not resolve every case: the actual roles of each party and the specific processing activity are relevant. Agreements and oversight processes should reflect those responsibilities.

A responsibility matrix can link each processing activity to its operational owner, the systems used, authorized access, required reviews, and escalation procedure. This helps ensure that an access request or incident does not remain unresolved because several teams assume someone else will handle it.

3. Build privacy and security into the design

Controls should accompany processing from its definition and throughout significant changes. Before launching a process, integrating a platform, or changing how data is used, it is advisable to check that the purpose is clearly defined, the requested information is necessary, and access and retention periods have been established.

Technical and organizational measures may include role-based access controls, appropriate authentication, access logging, encryption, and permission review procedures. The specific choice should reflect the risks and type of processing; no single measure can replace an assessment of each case.

Privacy by design also means avoiding the automatic reuse of data for purposes other than those for which it was collected. If a new purpose is proposed, it should be assessed before use begins, and the relevant documentation and information provided to individuals should be updated where appropriate.

4. Manage rights and retention as operational processes

Requests from individuals—for example, requests for access, rectification, erasure, restriction, or objection—require a workflow that makes it possible to locate the data, carry out any necessary verification, coordinate the teams involved, and respond within the applicable legal deadlines. Data portability may also be relevant in the circumstances provided for by law. Responses and exceptions depend on the right exercised and the circumstances; not all data must simply be deleted in response to every request.

To provide a consistent response, the operator needs to know which systems hold the data and which rules apply to each set. A common procedure should define the intake channel, assignment of responsibilities, searches across systems and suppliers, validation of the response, and recording of actions taken.

Retention should be linked to the purpose and the applicable obligations. When data is no longer necessary for the purpose that justified its use, the policy should provide for its erasure or, where appropriate, its restriction in accordance with applicable rules. Establishing criteria for each processing activity helps avoid both indefinite retention and deletions that disregard current obligations.

5. Prepare for incidents and oversee third parties

An incident response plan should establish how to detect and escalate a potential personal data breach, who assesses its effects, and how decisions are documented. Where required, it should also enable compliance with the notification obligations set out in the applicable legislation. Preparedness relies on clear roles, communication channels, and regular exercises or reviews; drafting a plan that staff are unaware of is not enough.

Suppliers and other third parties require an assessment proportionate to their access to data and the service they provide. The operator should document what information they receive, why they process it, which measures they apply, and how changes, incidents, and service termination are managed. If there are international transfers, the applicable conditions and safeguards must be reviewed for the specific case.

6. Maintain evidence, provide training, and improve continuously

The organization must be able to demonstrate how it governs processing activities. To do so, it is advisable to keep records of processing activities, policies, relevant assessments, risk decisions, and evidence of reviews and training up to date. When processing may pose a high risk to individuals’ rights and freedoms, the organization should assess whether a data protection impact assessment is required and follow the process established for that analysis.

Internal audits can check whether access permissions remain appropriate, retention rules are being followed, and rights and incident procedures work in practice. Training, in turn, should be tailored to people’s tasks: customer service staff, technical teams, and those who manage suppliers do not face the same day-to-day decisions.

Regular reviews make it possible to incorporate new systems, service changes, and audit findings without treating governance as a closed project. The goal is for responsibilities, controls, and documentation to continue reflecting how the operator actually uses data.

The place of ePrivacy in the framework

Compliance with the GDPR does not automatically replace ePrivacy obligations. In telecommunications, specific legislation may be relevant to aspects such as electronic communications and the use of certain data or technologies, but its application depends on the service, activity, and jurisdiction. The operator should therefore identify which sector-specific and national rules apply to each processing activity, rather than assume that a general privacy policy covers every situation.

An implementation roadmap

1. Define the scope: identify the services, processes, territories, and systems included.
2. Map and classify: record data, purposes, access, flows, third parties, and retention.
3. Assign responsibilities: define processing owners and the roles of privacy, security, business, and technology.
4. Prioritize controls: review minimization, permissions, technical safeguards, and procedures for rights and incidents.
5. Check regulatory alignment: analyze the GDPR, national legislation, and relevant ePrivacy requirements, as well as international transfers where they occur.
6. Document and review: maintain evidence, train staff, and address findings through periodic reviews.

This process does not replace the legal analysis of each processing activity. It helps turn obligations and policies into verifiable processes that are integrated into day-to-day operations and can be reviewed when services or data uses change.