Privacy Programme Roll-Out at a Six-Country Retailer with a Nine-Month Deadline
Verdant Retail Group operates 210 stores in six countries with 4,800 employees and 180 active vendors. A privacy programme was launched 18 months ago: the ROPA covers about 40% of processing activities, mandatory training completion is 62%, and the vendor register lists contract dates but not data categories or transfer mechanisms. Four reportable incidents occurred in the past year; the average time from detection to notification was 96 hours, and one incident was found by a journalist. A new national law takes effect in nine months and adds breach notification, DPO registration, and record-keeping duties. The board has approved EUR 300,000 and 1.5 FTE for the next year, but the CISO wants the budget for endpoint detection. The privacy lead reports to the CFO and has no standing agenda item at the executive committee.
1. Prioritize the first 90 days of the programme with a risk-based rationale.
Read the worked answer
Prioritize by legal exposure and reversibility, not by tidy completeness. First 30 days: fix incident response. An average of 96 hours from detection to notification breaches the 72-hour GDPR deadline, so establish a triage clock, a notification decision tree, a contact list, and a tabletop. This is the highest-severity gap because it is already recurring and visible. Second: complete the ROPA for high-risk processing (HR, CCTV, e-commerce, marketing, and the 180 vendors) rather than trying to reach 100%. Third: tier vendors and obtain DPAs and transfer details for the top 20 by data sensitivity. Fourth: role-based training for high-risk teams, not just completion. Fifth: put privacy on the executive committee agenda and assign owners.
Rationale: the new law is nine months away, but a breach is immediate; ROPA and vendor records are prerequisites for both. Do not spend the whole budget on endpoint detection without a privacy case; instead propose shared controls such as logging, access management, and asset inventory that serve both. Sequence the work so the nine-month deadline is met without ignoring live incident risk.
2. Define four to five KPIs with baselines and targets, and explain what each does and does not tell you.
Read the worked answer
KPIs: (1) percentage of reportable breaches notified within 72 hours; baseline from the four incidents, target 100%. (2) ROPA coverage of high-risk activities; baseline about 40%, target 90% in six months. (3) Tier-1 vendor DPA and transfer coverage; baseline unknown, target 100%. (4) Training assessment pass rate for high-risk roles; baseline 62% completion, target 85% pass. (5) DSAR on-time rate; baseline to be measured, target 95%. (6) Audit finding closure within agreed dates.
What they do not tell you: completion is not competence; ROPA coverage is not accuracy; notification time does not measure detection; vendor coverage does not measure security. Pair each with a quality check: sample ROPAs for completeness, test incident scenarios, audit a sample of vendor contracts, and review training content for role relevance.
Use a small dashboard with trends, not a one-off snapshot, and report to the board quarterly. If a KPI is green but a tabletop fails, the KPI is wrong. The programme should publish the definitions so the board does not compare incompatible numbers.
3. Recommend governance changes and explain how to handle the budget conflict with the CISO.
Read the worked answer
Governance: the privacy lead should have a standing executive agenda item and a direct escalation route to the board or CEO; reporting only to the CFO makes privacy a cost centre and weakens independence. Create a privacy steering group with legal, IT, HR, procurement, and business owners. Assign a single accountable owner for the programme and RACI for vendors and incidents.
Budget conflict: do not frame it as privacy versus security. Endpoint detection and logging also support breach detection and notification, so propose a joint business case with quantified downside (fines, incident cost, contract loss), phase the spend, and ask the board to record the residual risk if it chooses the security-only option. The EUR 300,000 and 1.5 FTE should be targeted at incident response, ROPA, and vendor management, with the CISO as an ally, not a rival.
Conclusion: the board should decide explicitly between competing risks, not by default. The privacy lead should present the regulatory deadline and the incident history together, and the CISO should co-sign the shared controls. Document the decision and review it at 90 days.