Policy roles and named responsibilities

When an organisation defines responsibilities, responsibility for each policy is given to a designated employee rather than left to be shared vaguely by everyone. That person's name is attached to the policy, so anyone who needs guidance or a decision knows exactly who to approach.

One name behind each policy

The designated person does not have to carry out every task themselves. Their role is to be the point of accountability: the one who makes sure the policy is fit for purpose, kept up to date and genuinely followed. A single employee might be given a whole set of related policies to manage — for example, one member of staff could be named as responsible for every policy covering how customer information is stored and shared.

Most policies are carried out day to day by IT and technical staff. A technician might set up access rights so only the right people can open a folder, run the overnight backups, or check that colleagues are following the password rules. The designated person makes sure this is happening and steps in when it is not.

Why names matter

Naming someone makes them answerable. If a policy has gone out of date or is being ignored, there is a person who can be asked about it and who must put it right. It also stops responsibility being spread so thinly that nobody takes action. Some named roles carry a legal duty too: whoever is responsible for data protection must make sure the organisation keeps to the law on handling personal information.