Team roles and access

Blankitt Privacy has four roles, from least to most privileged. Each role can do everything the ones below it can.

The roles

Role	Meant for	Can
Auditor	Compliance reviewers, internal audit	View requests, reports, and the audit trail. Read-only.
Data owner	System owners on the team	Everything above, plus work and complete their own collection tasks and record erasure attestations.
Privacy analyst	The people running requests daily	Everything above, plus manage requests end to end: verify identity, message requesters, create tasks, merge duplicates, build packages.
DPO	Whoever is accountable for the response	Everything above, plus sign off deliveries, decide appeals, edit settings and templates, and manage team roles.

"DPO" here is a product role. You don't need a statutory Data Protection Officer to use it, just someone accountable for what leaves the building.

How roles are assigned

• Your tenant's owners and admins (from the Blankitt Portal) get the DPO role automatically.
• Everyone else with access to the product defaults to Data owner.
• Under Settings, then Team & roles, a DPO can set an explicit role per member, which overrides the default.

Two access tips

• Not everyone needs a seat. People who only ever complete a task for one system are better registered as contact owners on the data source. They get secure task links by email, with no account at all. See Data sources and owners.
• Keep DPO tight. Sign-off and appeal decisions are the judgement points a regulator will examine. The shorter the list of people who can make them, the cleaner your story.