Absence as a Control: A Half-Day Resilience Drill for UK Data Governance

The test most organisations avoid

Data governance exercises often confirm the obvious: the people who normally make decisions can still make them, the people who hold the records can still find them, and the people who prepare regulatory evidence can still assemble it. That is useful, but it is not resilience. It is a demonstration of presence.

A more searching test is absence. In a controlled half-day exercise, the accountable executive, the Data Protection Officer or a senior data owner is marked unavailable. No calls, no informal approvals, no quiet route to the person who usually resolves ambiguity. The team must work with the authority, records and evidence that exist when the chair is empty.

The purpose is not to simulate a crisis for its own sake. It is to determine whether governance is embedded in roles, records and routines, or whether it depends on particular individuals. For UK organisations operating under UK GDPR, the Data Protection Act 2018 and sector-specific obligations, that distinction matters when the ICO asks for an account of how decisions were made, not simply who made them.

Designing the drill before the absence

A half-day format is usually sufficient if the scope is tight. The exercise should be commissioned in advance by the accountable body, not improvised by the governance team. Choose one absent role and one realistic scenario: a subject access request with a complex disclosure question, a proposed change to a high-risk processing activity, a supplier incident affecting records, or a request for evidence following a complaint. Avoid scenarios that require the absent person to be contacted; the point is to test the fallback.

Set three test lanes. The first is decision rights: who may approve, escalate, pause or accept risk when the usual approver is unavailable. The second is records access: whether the team can locate the current record of processing, the relevant DPIA, retention instructions, contractual controls and decision logs without relying on personal drives or inboxes. The third is regulator-facing evidence: whether the organisation can produce a coherent, dated and attributable account within a reasonable period.

Brief participants on the rules. The absent role cannot be consulted. Delegations must be found in documents, not invented in conversation. Any decision taken during the drill must be recorded as it would be in live operations. Observers should note delays, workarounds and points of confusion without intervening. At the close, the absent role may review the output, but only after the team has committed its decisions to record.

The drill should include a short pre-brief on psychological safety. The objective is to find weaknesses, not to grade individuals. A team that hides a workaround to look competent has defeated the exercise.

Artefacts to inspect, not merely discuss

A discussion about decision rights is weaker than an inspection of the instrument that grants them. Ask participants to produce the current delegation schedule, terms of reference, scheme of delegation or decision matrix. Check whether it names roles rather than individuals, whether it has an effective date, and whether it covers the scenario under test.

For records access, request the live artefacts: the record of processing activities, the information asset register, the retention schedule, the DPIA and any associated action plan, the data processing agreement, the incident log and the relevant access matrix. The question is not whether these documents exist somewhere. It is whether a competent colleague can find the current version, understand its status and use it to act within the drill window.

For regulator-facing evidence, ask for the pack that would be assembled if the ICO made a focused request the next morning. It should show the decision, the basis for it, the owner, the date, the evidence considered and the route by which the organisation will assure itself that the decision remains appropriate. If the pack depends on one person's recollection or a narrative written after the event, the drill has found something worth fixing.

Failure patterns UK organisations should expect

Several patterns recur. The first is oral folklore: authority is understood in practice but not documented, so the fallback is a phone call to someone who is technically on leave. The second is delegated authority that exists on paper but not in systems, leaving a named deputy unable to approve a payment, release a record or sign off a change.

The third is records access through personal accounts. A team can find the file only because one member has it saved locally or knows which shared inbox contains the latest version. The fourth is evidence assembled backwards: the organisation can describe what happened, but cannot produce contemporaneous records that show why it happened and who authorised it.

The fifth is escalation paralysis. Participants wait for permission that no one is empowered to give. The sixth is over-reliance on the DPO as a universal interpreter of every data question, which is both a continuity risk and a misunderstanding of the role. The seventh is a successful drill that produces no change: the team feels reassured, the observers write a short note, and the underlying dependency remains.

Turning findings into an accountable action log

Close the half-day with a triage session. Record each finding in plain language, then classify it by severity and type: authority, access, evidence, capability or culture. Assign a single accountable owner at the appropriate level, a due date and a defined evidence of completion. Avoid actions such as improve awareness or review documentation. Prefer actions that can be verified: publish a delegation schedule naming roles and deputies; migrate the current DPIA into the controlled repository; add the deputy approver to the workflow; test the evidence pack with a different team.

Add a retest date and a short definition of success. If the finding concerns decision rights, success may be that a deputy can approve the same class of decision within one working day without reference to the absent role. If it concerns evidence, success may be that the pack can be produced within four hours by a colleague who did not prepare it.

Report the results to the accountable body, including the findings that were not resolved. A drill that flatters the organisation is worse than no drill, because it creates false assurance. The measure of success is not how smoothly the half-day ran. It is whether the empty chair exposed a dependency that has now been removed from the critical path.

Run the exercise at least annually, and after significant changes to roles, systems or suppliers. Rotate the absent role so that the organisation does not merely test one person's deputy. The aim is a governance model that can be operated by the next competent person, with the records and authority to act. That is the standard a regulator, a board and a customer are entitled to expect.