Days 0–30 — Discover & map:
- Meet stakeholders: Product, Legal, Security, Privacy/DPO, Ops to clarify use cases and risk appetite.
- Create a data map for the project: sources, flows, storage, access, third-party transfers, retention.
- Identify sensitive data using categories (PII, special category data, health, financial, children’s data) and flags (direct identifiers, quasi-identifiers). Use automated scanners (e.g., regex, DLP tools) plus sample data reviews.
- Determine lawful basis (GDPR) or permissible uses/consumer rights (CCPA) and record intended processing in a Project Privacy Checklist.
Days 30–60 — Assess, mitigate, document:
- Conduct a Data Protection Impact Assessment (DPIA) for high-risk processing; document risks and mitigations (minimization, pseudonymization, encryption, access controls).
- Specify technical controls: encryption-at-rest/in-transit, role-based access, audit logging, retention policies, differential privacy or k-anonymity where needed.
- Draft required artifacts: Record of Processing Activities (ROPA), consent records or opt-out mechanisms, data sharing agreements, vendor assessments.
- Run a privacy review session with Privacy/DPO and Legal; capture decisions and approvals in a formal sign-off document stored in project repo/registry.
Handling ambiguous cases / escalation:
- If legal/regulatory ambiguity arises, escalate in order: Privacy Lead/DPO → Corporate Legal → Compliance Officer → CTO/Product Exec for business-risk trade-offs.
- For urgent ambiguity affecting launch, request a temporary hold and document rationale for any interim measures.
Operationalize compliance:
- Add automated checks to CI (schema validation, PII detection), periodic audits, and a runbook for data subject requests.
- Train project team on obligations and include privacy sign-off as a pre-release gate.
Example: For a model using location + purchase data, I’d pseudonymize IDs, run DPIA, require vendor SOC 2 for any cloud processors, and obtain DPO sign-off before production.
