Forty Subsidiaries, Twelve DPOs, and an AI Training Plan
Verdant Group is a consumer-goods company with 40 subsidiaries, 6,000 employees, and operations in the EU, UK, US, and Singapore. It has no central record of processing activities; each subsidiary uses its own spreadsheet. Twelve people carry the DPO title, but most also run marketing or IT. The board approved an AI feature that trains a recommendation model on customer support transcripts and purchase histories. Budget for privacy was cut 20% this year. A regulator has asked for the company's accountability documentation after a customer complaint about profiling. The general counsel wants a 90-day remediation plan. The only privacy metric reported to the board is the number of DSARs closed. There is no incident-response playbook and no vendor risk tiering.
1. What should the 90-day remediation plan prioritize, given the budget cut and regulator request?
Read the worked answer
Prioritize evidence of accountability and the highest-risk processing. In the first 30 days, build a central record of processing activities for the AI profiling, customer support, marketing, HR, and vendor data flows. Assign owners and use a common template rather than perfecting every subsidiary. Also map the twelve DPOs, identify conflicts, and appoint a lead privacy contact for the regulator. In days 31-60, complete a DPIA for the AI model, review lawful basis and transparency, and create an incident-response playbook with a breach-assessment template. In days 61-90, introduce vendor risk tiering, a privacy metric beyond DSAR counts, and a board dashboard covering risks, incidents, DPIAs, and training.
The 20% budget cut means the plan should focus on high-risk processing and reusable templates, not a large new tool. The regulator's request should be answered with a remediation plan, not a claim that everything is complete. Assign one accountable executive and track deliverables weekly.
2. How should Verdant address DPO independence and accountability reporting?
Read the worked answer
Verdant should first clarify which DPO appointments are legally required and which are honorary titles. The twelve DPOs who also run marketing or IT create conflicts of interest, because they cannot independently monitor processing they control. The company should separate the DPO role from operational roles, give the DPO direct reporting to the highest management level, and provide sufficient resources and access to the board. If a subsidiary does not require a DPO, rename the role to privacy lead to avoid confusion.
Accountability reporting should go beyond DSAR counts. The board should see a privacy risk register, DPIA status, incident trends, vendor risks, transfer risks, training completion, and regulatory inquiries. The DPO should have a documented right to be consulted on the AI feature and to escalate disagreement. The general counsel should not direct the DPO's conclusions. These steps matter because the regulator will test whether the DPO is independent in fact, not just in title.
3. What lawful basis and governance steps are needed before training the AI model on support transcripts and purchase histories?
Read the worked answer
The lawful basis depends on the jurisdiction and the content of the transcripts. If the model uses purchase histories and support transcripts for a new recommendation feature, legitimate interest may be available, but Verdant must complete a three-part test and respect reasonable expectations. If transcripts can contain health, financial, or other special-category data, a condition under Article 9 GDPR is also needed. Consent is unlikely to be practical for existing data, but the company should offer a clear opt-out and honor objections. In Singapore, consent or an applicable exception must be assessed; the UK and US require separate analysis.
Governance steps include a DPIA before training, data minimization, redaction of sensitive content, retention limits, and a check that the original collection notice permits this secondary use. The company should document model purpose, training data sources, evaluation for bias, human oversight, and access controls. Vendor contracts must prohibit reuse and require deletion. The board should approve the risk decision, and the DPO should be consulted. Finally, Verdant should publish a plain-language explanation of the profiling and provide a way to request human review where required.