Who approves when, as a policy instead of an arrangement
The single-stage approval of the core suffices as long as one person decides. As soon as a policy is to be approved first by the data protection officer and then by the information security officer, or two of three team leads have to agree, a policy for the approval itself is needed. The module keeps such approval policies with stages that run serially, in parallel or by quorum, with approvers drawn from role, users, person group, officer register or the responsibility on the object, with deadlines per stage, deputies and escalation. A vendor catalogue ships templates; without the module everything stays as before.
"The DPO approves" is not a person but an appointment. The stage points at the officer register, and whoever is currently appointed there, with a deputy in the deputising case, is the approver. A change of staff does not change the policy.
Quorum stages define how many approvals from a group suffice. The four-eyes principle prevents the same person from serving two stages, even if they belong to both groups.
Every stage carries its deadline. When it expires, the run escalates to the configured place instead of silently stalling. The head task stays locked until the run is through, and the inbox shows what is waiting for whom.
The evidence of who approved a policy is no longer an e-mail thread but a run with stages, deadlines and names.
Schedule a no-obligation demo – we will show you the module with your own use cases.
