Conflicting Obligations and Missing Evidence
A US-headquartered healthcare analytics firm serves EU hospital customers. Its GDPR DPIA requires minimizing personal data, but a state records law requires seven-year retention of certain clinical data. A new customer contract demands 24-hour breach notification with indemnification and a right to audit, while the firm's standard is 72 hours. An internal audit found 34 of 90 systems lack current evidence for quarterly access reviews, and 11 of those belong to a subsidiary acquired eight months ago. The customer signs in three weeks.
1. How should the firm reconcile the retention and notification conflicts?
Read the worked answer
Conflicts are resolved by jurisdiction and data category, not by picking the most convenient rule.
Retention: build a data map and a retention schedule keyed to data type and legal basis. Where a state law mandates seven-year retention, the firm must retain only the minimum fields required and apply minimization to everything else. Document the legal basis for each retention period; "the DPIA says minimize" and "the statute says retain" can both be true for different fields.
Notification: the contract's 24-hour clock is stricter than the 72-hour regulatory standard, but the contract may also define "breach" differently and attach indemnity. Legal must review whether 24 hours is operationally achievable; a promise the firm cannot keep is worse than a negotiated term. Clarify the trigger (confirmed vs. suspected), who notifies whom, and indemnity caps.
The CISO's role is to state what is technically detectable and confirmable within each clock, and to refuse to sign terms the monitoring and legal process cannot support.
2. What should the compliance program do about the 34 systems without current access-review evidence?
Read the worked answer
Treat this as an ownership and evidence-design failure, not a rounding error.
- Scope correctly. Confirm the 90-system inventory is complete; the subsidiary's 11 systems suggest the inventory itself is stale.
- Assign control owners for each system, with named individuals and escalation paths. Unowned controls never produce evidence.
- Automate collection where possible - pull access reviews from the identity provider rather than relying on spreadsheets emailed quarterly.
- Prioritize by risk: systems holding regulated data or with privileged access first; low-risk internal tools on a sampled cycle.
- Use interim attestations for the subsidiary while it is integrated, signed by its leadership.
- Report honestly to the audit committee: 34 gaps, remediation dates, and the residual risk if the customer audits before closure.
Backdating or retroactively fabricating evidence would convert a control gap into a integrity and legal problem.
3. The customer wants to audit in three weeks. How should the firm respond?
Read the worked answer
Negotiate the scope and sequence rather than refusing or over-promising.
- Clarify the audit right: what standard, what systems, on-site or questionnaire, notice period, confidentiality, and cost. Many "audit rights" can be satisfied with a recent independent report plus a targeted questionnaire.
- Offer what is true today: current certifications, the internal audit findings with remediation plan, and evidence for in-scope systems.
- Be explicit about gaps: the 34 systems, the subsidiary, and the remediation timeline. Customers generally accept a credible plan more readily than a surprise finding.
- Escalate contract terms that exceed regulatory obligations or the firm's ability to detect and confirm incidents, including indemnity language.
Signing an unachievable 24-hour notification commitment to win the deal creates a breach of contract waiting to happen; the CISO should put that in writing to the deal owner.