How do you respond to an inquiry from the State Data Protection Inspectorate?

First, write down the deadline and appoint one person responsible. Read the inquiry twice and break out every separate question into a list — a single sentence often contains three of them.

If the deadline is genuinely too short, it is better to ask for an extension in good time and explain why than to be late. Silence is the worst option: it turns a simple inquiry into a procedure.

Almost the same documents are always requested: the record of processing activities, internal policies, privacy notices, contracts with processors, the breach log, and, for video surveillance, the justification and a description of the monitored areas. If these documents are in order, the response can be written in a day.

Do not backdate documents. If a document did not exist, it is better to say it is being prepared and give a deadline. A falsified date is a far bigger problem than a late document.

If something is missing, say so directly and state what you will fix and by when. A remediation plan offered voluntarily often changes the whole tone of the conversation that follows.

Do not provide more than is asked: extra documents open up new questions. Do not disclose personal data that was not requested. Do not send the response without a manager's review, and keep a copy of everything you send.

If the inquiry relates to a possible breach, a dispute or a fine, it is worth consulting a lawyer before sending. For procedural rules and deadlines, see Article 14 and Article 21 of the Law on Legal Protection of Personal Data (ADTAĮ).

In most cases, the inquiry ends there: the authority assesses the information provided and closes the file or issues recommendations. Less often, further documents are requested or an on-site inspection is scheduled, and then the key thing is that the information provided the second time does not differ from your first response.

If you committed to fixing something, do it by the stated date and inform the authority yourself, without waiting for a reminder. Confirming completion on your own initiative is the cheapest way to close the matter.

Keep all correspondence with the authority in one file, together with the attachments sent. If you need to answer a similar question a year later, you will have a ready foundation instead of starting from scratch.