Prioritising a three-person privacy office after a 30% budget cut
At a 9,000-person Indian conglomerate with retail, insurance and logistics units, the privacy office has three people and reports to the General Counsel. There is no DPO. Fourteen business units run their own vendor onboarding. An internal review found that 62% of 410 vendors handling personal data have no data processing agreement, the DPIA template has been used twice in two years, and 70% of customer notices still cite the repealed Section 43A/SPDI regime. A board committee asks for a 12-month plan and a dashboard. The CFO cuts the privacy budget by 30% and freezes two hires. The CISO argues privacy should sit under security; the CMO wants faster marketing consent. The insurer unit is launching a product in eight weeks.
1. What should the privacy office do in the first 90 days, and why?
Read the worked answer
Prioritise by harm and by irreversible deadlines, not by tidiness.
1. The insurer launch (weeks 1-8). A new insurance product is the highest-risk processing event and has a hard date. Run a DPIA, fix the notice, confirm the lawful basis and consent flow, and review the data flows to the insurer's partners. This is the one place where stopping the launch is a credible option.
2. Vendor contracts (weeks 1-12). 254 vendors without DPAs is an active exposure. Rank by data volume, sensitivity and access, then issue a standard DPA pack to the top 60 and suspend onboarding for vendors that refuse. Do not try to fix all 254 at once.
3. Notice refresh (weeks 1-10). Replace the Section 43A/SPDI language with DPDP-compliant notice, starting with customer-facing units. A wrong notice undermines every consent downstream.
4. Incident readiness (weeks 4-12). One page: who decides, who notifies the Board and data principals, and how the 24-hour contract notices work.
The budget cut means the office must use business-unit privacy champions and templates rather than hire. Defer bespoke training and maturity assessments.
2. Where should the privacy function report, and what governance model fits a decentralised conglomerate?
Read the worked answer
Privacy should not report to the CISO or the CMO. Security is a control function with a different objective, and marketing has a direct commercial interest in faster consent. Reporting to the General Counsel is defensible for legal interpretation but weak on operational authority. The stronger model is a privacy office led by a senior privacy officer reporting to the CEO or the board risk committee, with a dotted line to legal and security and a standing board agenda item.
Use a federated RACI: the central office owns policy, notice templates, DPIA methodology, training and regulator relationships; business units own their processing inventory, vendor onboarding and first-line decisions; security owns technical safeguards; legal owns interpretation and contracts. Each of the 14 units needs a named privacy champion with defined time allocation. Vendor onboarding should be a single gate with privacy, security and procurement sign-off. If any entity is notified as a Significant Data Fiduciary, appoint an India-based DPO with independent reporting and resource.
3. Which metrics should go to the board committee, and which should be rejected as vanity metrics?
Read the worked answer
Choose metrics that show risk reduction and decision quality, not activity.
Use: percentage of high-risk vendors with signed DPAs (with a target and trend); percentage of high-risk processing with a completed DPIA before launch; consent-withdrawal requests completed within the committed SLA; breach notifications made within contractual and statutory timelines; retention deletions completed on schedule; data-subject request timeliness; and open high-severity audit findings with owners and dates.
Reject: number of training sessions delivered, number of policies published, total employees trained, and page views of the privacy intranet. These measure effort, not control effectiveness.
Add one forward-looking metric the board can act on: privacy debt - the count of known processing activities without a lawful basis, notice or DPA, aged by days. Report it with a burn-down plan. Given the 30% cut, show explicitly which risks are being accepted, by whom, and when they will be revisited; the board should record that acceptance rather than hear that everything is on track.