The Regulation Arrives One Month After Go-Live

Build a decision-ready picture; opinion versus evidence determines whether the sponsor listens.

Quantify:

• Applicability and timing - does the rule cover data already held, and is there a grace period? If it bites in month five and you launch in month four, you get roughly one month of lawful operation before mandatory rework.
• Cost comparison - 90,000 for design hooks now versus 380,000 plus a retrospective data clean-up and possible downtime later. Retrofit cost is nearly always higher and lands under time pressure.
• Benefit exposure - the platform's value depends on using the data for targeting; if consent is not captured at the point of collection, existing records may be unusable and the benefit case weakens.
• Risk exposure - regulatory penalty range, audit findings, reputational cost, and any contractual warranties with the customer.

Then: raise it as a change request with the 90,000 hook as the recommended minimum, and route it through the CCB or governance body. You are not spending management reserve; you are sizing the decision.

You cannot make the compliance call, but you must not let it disappear.

Do:

• Restate the exposure once, in writing, with numbers - concise, factual, no lecturing.
• Escalate in parallel to the compliance officer and, if unresolved, to the sponsor's sponsor or the PMO. Compliance exposure is a legitimate escalation; it is not disloyalty.
• Record the instruction, the date, the risk accepted, and the accepting party in the decision log and risk register.
• Propose the cheapest harm reduction: the 90,000 design hook, consent capture at the collection point, and a funded phase-2 deletion workflow.

Do not: quietly re-plan, hide the item from status reporting, or imply in any report that the platform is fully compliant.

Reasoning: the sponsor owns the business decision; you own making it informed, recorded and visible at the right level. If the organisation later faces an audit, a documented escalation protects both the project and the individuals - and a paper trail of silence would not.

Convert an unmanaged exposure into a managed one.

• Risk register: a named risk with a risk owner (not you by default), the trigger date, probability and impact, and a defined response - not "monitor".
• Decision log: the sponsor's acceptance, dated, with the information they were given.
• Benefits tracking: treat lawful data use as a dependency of the benefit case; if consent is absent, forecast realised benefits down accordingly rather than reporting the original projection.
• Delivery plan: phase-2 scope, estimate and funding identified now, with a target date before the regulation takes effect.
• Monitoring: regulatory watch assigned to compliance; a review point at go-live plus 30 days; status reporting that separates "delivered" from "compliant".

Why: projects fail quietly at the seam between delivery and compliance. Making the dependency explicit means the first audit question has an answer, and the fix is already planned rather than improvised.