A pilot with 40,000 real customer records and a three-week clock
A retail bank is piloting an analytics vendor's churn model. To make the pilot realistic, the delivery team has loaded 40,000 live customer records into the vendor's cloud test environment, including partial account numbers and transaction histories. The data protection officer has not been consulted. The vendor contract contains a clause permitting use of customer data for unspecified product improvement. Go-live is in three weeks and a senior manager has instructed the team to proceed, noting that the pilot is internal and short-lived and that the vendor is well known. A junior analyst has raised a written objection, which the senior manager has asked you to overrule.
1. What do you do in the first 48 hours, and what do you do about the instruction to overrule the objection?
Read the worked answer
The instruction to overrule the objection is the part that cannot be complied with. Overruling a written compliance objection is not a delivery decision, and doing so would place both the analyst and you in an indefensible position if the matter is later reviewed.
First 48 hours:
- Establish the facts in writing before acting: what data fields are in the environment, whose data, what the contract permits, and whether any transfer outside the organisation has occurred. Partial account numbers plus transaction histories are likely to be identifying in combination, so treat the data as personal data until told otherwise.
- Do not destroy evidence of the objection. Preserve the analyst's note and your own record of the instruction, unedited.
- Escalate to the data protection officer today, not after the pilot. The DPO's involvement is not optional and not something the team can self-certify.
- Suspend the data load into the vendor environment pending the DPO's view. A three-week go-live is a cost; an unlawful transfer is a different category of problem with regulatory consequences and a much longer recovery time.
Respond to the senior manager in writing, factually and without accusation: the data set as configured, the contract clause as written, the DPO escalation, and what can continue in the meantime. Offer a path - pseudonymised or synthetic data, a restricted enclave, a contract amendment - so the instruction is answered with options rather than a refusal. If the instruction is repeated after that, escalate through the compliance line and record that you did.
2. How would you weigh the competing considerations, and what would you document as the decision rationale?
Read the worked answer
The competing considerations are real but not symmetrical, and the weighting should say so.
On one side: three weeks of delivery time, a pilot that is short-lived, a reputable vendor, no evident intent to harm, and a manager who believes the risk is small. On the other: 40,000 identifiable individuals who have not been told their transaction history is in a third party's test environment, a contract clause that permits uses the bank cannot describe, no DPO involvement, and a written objection on file.
The asymmetry is that delivery delay is recoverable and reversible within weeks; an unauthorised disclosure is not recoverable, affects people who are not in the room, and carries regulatory and reputational exposure that scales with the data set. The seniority of the person giving the instruction does not change that arithmetic, and "internal and short-lived" is a statement about intent, not about exposure.
Document as the rationale:
- The data fields in scope and the identification risk assessment.
- The contract clauses that bear on permitted use, quoted.
- Who was consulted, when, and what they said - including the objection and the instruction.
- The options considered with their delivery cost.
- The decision, the accountable owner, and the review date.
If the decision taken is to proceed, the record should show that it was made with the risks stated and by someone with the authority to accept them. If the record cannot show that, the decision is not yet safe to make.