The compliance refusal to a powerful stakeholder
You are BRM for a retail bank's marketing division. The VP of Marketing wants a new social listening platform that ingests public posts, including those of EU residents, retains them indefinitely and is hosted by a vendor in a country with no adequacy decision. Legal and the DPO have said clearly that this cannot proceed as described. The VP argues that two competitors already do it, that the platform is central to a £4m campaign launching in ten weeks, and that 'IT is hiding behind compliance'. She controls £8m of the IT spend and sits on the investment board that reviews your function's budget. Your relationship with her has been good until now, and she has copied her escalation to the chief marketing officer.
1. How do you handle the next conversation with the VP?
Read the worked answer
Start from the need, not the vendor.
- Acknowledge the campaign and the ten-week date. The VP needs to hear that the business outcome is understood before any constraint is discussed.
- Separate the need from the proposed solution. What decisions does the campaign need to make, on what data, for how long? Some listening use cases work with aggregated or anonymised data and short retention.
- Bring legal and the DPO into the same conversation, not as a message you relay. 'IT is hiding behind compliance' survives only while compliance is a rumour.
- Offer real options: approved hosting region, retention limits, vendor contract changes, a narrower data set, or a later phase.
- Be unambiguous about the line: indefinite retention of identifiable EU posts in a non-adequate country is not a negotiable position for you to trade.
Holding the line while offering alternatives is the relationship work. Simply citing the DPO transfers the conflict and damages your credibility.
2. What is the right escalation path, and what exactly should you escalate?
Read the worked answer
Escalate the decision, not the person.
- Escalate to the CMO and the chief risk officer together, with the business need, the constraint, the options and your recommendation. Copying the CMO was an invitation to put the issue where it belongs.
- Do not ambush the investment board. The board reviews investment, not individual data-protection exceptions; taking it there forces a public contest that the VP will frame as IT obstruction.
- Document the position and the options so the record is about the decision, not about who won.
- Keep the VP informed of the escalation before it happens. A BRM who escalates without warning converts an ally into an opponent.
The relationship survives a clear no if the no is about a specific configuration and comes with a route forward. It rarely survives being surprised.
3. What does this case test about the BRM role's authority?
Read the worked answer
BRM authority is credibility-based, not positional. You do not own compliance, and you do not own the marketing budget. What you own is the quality of the relationship and the flow of honest information between the business and IT.
- You are not the decision-maker on data protection. Your value is making the constraint intelligible and the alternatives real.
- You are accountable for how the no is delivered and for whether the VP still has a working route into IT afterwards.
- You must not become an advocate who hides risk to preserve the relationship; that trades short-term harmony for a much larger failure.
If the VP goes around IT, the loss is not that a tool is bought; it is that the relationship stopped being the place where difficult trade-offs are made. That is the outcome to prevent.