The Compliance-Deadline Strategy That Isn't a Strategy
A 900-person digital-health company sells a wellness app in the US and is acquiring a Berlin clinic group with 40 staff and 120,000 patient records. The board has approved a 'GDPR Compliance Program' with a fixed nine-month deadline, a €1.2M budget, and one success criterion: passing an external audit. The newly hired privacy lead learns that the 18-month product roadmap contains three AI features that infer health conditions, and that the acquisition's records sit in four incompatible systems. The CFO wants budget released against audit milestones; the CPO wants to re-scope the whole effort.
1. What should the privacy lead do first to convert this into a privacy strategy rather than a compliance project?
Read the worked answer
Start with an enterprise privacy risk and materiality assessment, not a gap analysis against the Regulation. Gap analyses produce a to-do list; a strategy needs a defensible answer to where the organization's privacy risk actually concentrates and what it is willing to accept.
Concretely: (1) Map the top business objectives for the next 24 months - EU market entry, the acquisition, the AI roadmap - and identify which privacy exposures could block or degrade each one. (2) Size the exposures using the facts already available: 120,000 patient records in four incompatible systems means unresolved retention, transfer, and subject-access exposure; AI inference of health conditions means special-category data at scale and likely a DPIA obligation before launch. (3) Put a risk appetite statement to the board: what classes of processing the company will not do, which it will do only with controls, and who accepts residual risk.
Only then write the roadmap. The audit becomes one milestone in a multi-year plan, not the definition of success.
2. How should the lead respond to the CFO's proposal to release budget only against audit milestones?
Read the worked answer
Don't fight the mechanism; change what it measures. Milestone-gated funding is reasonable governance for a finite project but structurally wrong for a capability that must persist - it produces a burst of activity before the audit and then defunds the operation that keeps the company compliant.
A workable counter-proposal separates two funding lines:
- Run - the steady-state cost of operating the program (staff, tooling, DSAR handling, training, vendor reviews). Funded as a baseline, reviewed annually, not tied to milestones.
- Change - remediation and build tranches, which can absolutely be gated on milestones.
Then propose milestone definitions that reward capability rather than paperwork: 'a data subject access request for an acquisition record is fulfilled end-to-end inside the statutory period in a live test', rather than 'DSAR procedure documented'. This gives the CFO the financial control they want while preventing the program from being declared finished on audit day.
3. Which strategic risks should the lead escalate to the board, and why those?
Read the worked answer
Escalate the ones the board can actually act on and that have business consequences, not a list of legal citations. Three candidates:
- The AI roadmap. Inferring health conditions from app behavior creates special-category data and a likely DPIA requirement before launch. If the features are built first and assessed later, the company may have to rebuild or withdraw them - a product risk with a legal cause.
- Acquisition integration debt. Four incompatible record systems for 120,000 patients means the company may not be able to honor access, erasure, or retention obligations for those individuals. This is a concrete, demonstrable failure mode, not a hypothetical.
- International transfer architecture. Post-Schrems II the company needs a documented transfer mechanism and a transfer impact assessment for each route; the EU-US Data Privacy Framework is one available route but requires eligibility and ongoing diligence.
Each is framed as: what happens, how likely, what it costs, what decision is requested by when. Risks the board cannot act on belong in the risk register, not the board pack.