340 Open Requests and Six People
A subscription media company has 340 open data subject requests. Thirty percent are past the statutory response period and the oldest is 190 days old. Intake is a shared email inbox; staff copy details into a spreadsheet; fulfillment requires manual lookups in seven systems, two of which have no search by email address. Six FTE handle requests alongside vendor reviews, where 14 vendors are waiting and two are already processing data under expired contracts. Annual privacy training sits at 61% completion with three weeks left in the cycle. The CPO has one additional headcount for the year.
1. How should the CPO sequence the work with one additional head, and what is the reasoning?
Read the worked answer
Sequence by irreversibility and external exposure, not by volume.
The overdues are already a regulatory event: 102 requests past deadline, with a 190-day outlier, is the kind of pattern that turns an inquiry into an enforcement matter. That gets the new head as a dedicated request-handling lead, plus a temporary contractor funded from elsewhere if possible.
Vendors under expired contracts are the second priority - two vendors processing without a live agreement is an uncontrolled processing relationship, and it is cheap to fix relative to its risk. The media company likely has contract templates already; the bottleneck is a queue, not a capability.
Training at 61% is the lowest priority. It is visible, it is easy to measure, and it is the least consequential of the three. Resist the instinct to chase the number because it is the only one the CPO can move without help.
The sequencing principle: fix what is actively harmful and externally observable, then what is structurally broken, then what is merely incomplete.
2. Where should the single automation investment go, and where would automation be premature?
Read the worked answer
Automate intake and routing. The shared inbox plus spreadsheet is where requests are lost, duplicated, and aged - an intake portal that captures identity, request type, and jurisdiction and creates a tracked case with an SLA clock addresses the root cause of the overdue count and produces data nobody currently has.
Do not automate fulfillment yet. Two systems cannot be searched by email address; an automated orchestration layer in front of them would fail at exactly the step that takes the time. Fix the identity linkage in those two systems first (or define a manual lookup path and staff it), then consider orchestration.
The general rule: automate the step whose failures are invisible, not the step whose failures are already well understood. Here the invisible failure is a request sitting unacknowledged in a shared inbox; the visible one is a slow manual lookup.
3. How should the CPO get vendor onboarding unstuck without letting quality slip?
Read the worked answer
The 14-vendor queue is almost certainly a capacity artifact, not a risk artifact: one questionnaire, applied with equal depth to a stationery supplier and a cloud transcoding vendor, produces identical work for wildly different risk. Tier by data access and processing role, then apply proportionate review.
- Tier 1 (personal data at scale, special category, or processor with broad access): full review, DPA, transfer assessment if applicable. Two vendors here.
- Tier 2: standard DPA plus a short risk questionnaire, reviewed on a defined cadence.
- Tier 3: acceptance of standard terms, no bespoke review.
This lets the 12 low-risk vendors clear quickly and releases reviewer time for the two that matter. For the two vendors already processing under expired contracts, treat them as an exception process: extend under the existing terms in writing today, subject to full review within 60 days. 'Expired' is worse than 'imperfect' - get paper in place, then improve it.