Starting Point: Your Privacy Program in One Minute

• In a sentence, how would you describe your current privacy program's scope and primary goal?
• How many people on your team have regular responsibility for privacy operations? Options: 1 person, 2-4 people, 5-9 people, 10-19 people, 20+ people
• Who owns the canonical data inventory today? Options: Privacy team, IT or engineering, Security, Legal, Data governance, No single owner
• What regulatory jurisdictions do you currently treat as priorities? Options: EU (GDPR), UK, California (CCPA/CPRA), Other US state privacy laws, Sector specific like HIPAA, Other
• How often do you update your data processing records? Options: Weekly, Monthly, Quarterly, Annually, Ad hoc / no schedule

Where the Current System Trips You Up

• What single recurring failure in your DSAR or data map process would make you walk away from the current approach?
• Walk me through the most recent DSAR that missed its SLA, what happened and who owned the failure?
• On average, how many subject access requests do you get per month across employees and consumers? Options: 0-10, 11-50, 51-200, 201-500, 500+
• Which part of the request lifecycle causes the biggest manual effort, intake, discovery, review, redaction, or delivery? Options: Intake, Automated discovery, Review / legal analysis, Redaction, Delivery / response, Post response documentation
• Typically, what is the elapsed time from intake to closure for complex requests involving multiple systems?
• If your next audit required you to produce end to end data lineage for a set of 50 subjects within 30 days, what single blocker would stop you?

The Other Paths You Are Weighing

• Under what conditions would you choose to stay with your incumbent or DIY approach rather than adopt an external platform?
• Tell me which alternatives you are evaluating, including the incumbent, other vendors, or an internal build Options: Incumbent vendor, Other commercial privacy platforms, Custom internal build, Consulting firm or managed service, Open source tools, No formal alternative yet
• State the one capability you would need to add to an internal solution to avoid switching to a vendor
• Identify the internal champion for replacing the incumbent and the teams most likely to resist Options: CPO / DPO, Head of Legal, Head of IT / CTO, Head of Security / CISO, Head of Compliance, Procurement
• Provide the exact condition, such as a pilot metric or legal clearance, that would make you approve a purchase within 30 days

What You Miss About Third Parties

• Who in your organization is accountable for the vendor data inventory, and why might that ownership be insufficient?
• List the categories of third parties that receive personal data from you Options: Cloud infrastructure providers, SaaS applications storing customer data, Analytics vendors, Marketing platforms, Payroll and HR systems, Payment processors, Outsourced service providers, Other
• When was the last time you reconciled vendor questionnaires against observed data flows, and what changed since then? Options: In the last 30 days, 30-90 days ago, 3-6 months ago, 6-12 months ago, More than 12 months ago, Never
• Which vendor connections lack API access or documented data schemas that would prevent automated field mapping? Options: SaaS apps, Legacy on-prem systems, Payment processors, HR / payroll systems, Analytics platforms, Marketing integrations, Other
• Name one vendor related risk that would stop deployment next quarter

Regulatory Boundaries That Matter

• If a regulator asked for your complete processing records for EU residents covering the last six months, what parts would you struggle to produce?
• Describe the last DPIA you completed, the teams involved, and any outstanding gaps it revealed
• Do you maintain separate processing records per jurisdiction or a consolidated record with jurisdiction tags? Options: Separate records per jurisdiction, Consolidated record with jurisdiction tags, Partial tagging but not comprehensive, Not currently maintained
• State the response time in business days you must meet for consumer DSARs under your top priority laws Options: 10 business days, 20 business days, 30 calendar days, 45 calendar days, Other
• Would inadequate cross border transfer documentation be a showstopper for a major customer audit or contract renewal? Options: Yes, showstopper, Maybe, depending on customer, No, we have mitigation, Unsure

How You Measure Success and Who Signs Off

• Name the single metric that, if a pilot failed to improve it, would make you walk away from the engagement
• List the KPIs your leadership tracks today for privacy operations Options: Coverage of data maps, DSAR SLA compliance rate, Average DSAR handling time, Automated classification accuracy, Reduction in manual hours, Vendor inventory completeness, Audit readiness score, Other
• When you say coverage of data maps in your success criteria, which systems or data types must be included first?
• Identify the official signatory who can accept pilot results and authorize commercial terms Options: CPO / DPO, Head of Legal, VP Operations, CFO, Procurement lead, Other
• Select which pilot outcomes you would find acceptable Options: 25% reduction in manual hours, 90% automated classification accuracy, End to end DSAR SLA met, Vendor inventory fully reconciled

What Must Be True Before We Start Deploying

• Suppose several critical data sources do not offer an API, what would that do to your timeline and who would resolve it?
• Please enumerate the system categories, for example HR systems or cloud storage, that are non negotiable for integration Options: HR systems, CRM / support platforms, Cloud storage, Email systems, Finance / billing, Security logs, On premise databases, Other
• For each critical system, list the current access owner and their role and whether they can provide credentials within 30 days
• Do you have a dedicated project manager and an internal deployment team allocated, and what is their capacity? Options: Yes, allocated full time, Yes, allocated part time, No, not allocated
• Would a legal sign off timeline longer than 90 days be a deal breaker for this project? Options: Yes, No, Depends on mitigation, Unsure

Making a Go or No Go Decision

• Assuming the pilot delivers the agreed KPIs, what remaining approvals or blockers would prevent you from signing within 14 days?
• Specify the exact documents or contract clauses you need from the seller to complete legal and procurement review Options: Data processing agreement, Security addendum, Statement of work, Service level agreement, Integration runbook, Data flow diagrams, Other
• Provide the job titles and functions that must approve the purchase for budget, legal, security, and operations Options: CPO / DPO, Head of Legal, CISO / Head of Security, VP Engineering, Procurement lead, Finance approver, Other
• Estimate the fastest time procurement could issue a purchase order after approvals and list common delays Options: 0-7 days, 8-14 days, 15-30 days, 30-60 days, 60+ days
• Are you enabled to sign if the pilot hits its targets, or will you need additional executive approval? Options: I can sign, I need executive approval, Procurement must finalize, Unsure

• Solution Experience Session

• Confirm the current state and its cost
• You confirm the demonstrated DSAR workflow reduces manual touchpoints and meets your SLA target for response time.
• Provide two representative DSAR requests and the list of your top 10 data stores to use in the sandbox run.
• Run your representative DSAR end-to-end
• You confirm the discovery and mapping approach covers the critical data stores you identified and highlights vendor sharing gaps you currently miss.
• Provide access details or a sample extract for one data source for the sandbox discovery run.
• Prove automated data discovery and mapping on a sample source
• Run a sandbox discovery on the provided sample data sources and deliver a findings report with coverage metrics and identified vendor sharing before the next session.
• You agree on the remaining evidence and acceptance criteria needed to move toward procurement and deployment decisions.
• Draft acceptance criteria that specify required coverage percentage, DSAR SLA target, and required audit artifacts for regulatory review.
• Demonstrate vendor assessment and audit documentation
• Validate this maps to what you described
• Agree remaining evidence and next decisions

• Solution Experience Session
• Solution Experience Deck
• Solution Brief

• meeting
• slides
• document

• Automated Data Discovery and Classification
• Continuous Data Flow Mapping and PARs
• DSAR Intake and Automated Fulfillment
• Consent and Preference Center Integration
• Privacy Impact Assessment Workflow and Templates
• Vendor and Third-Party Data Inventory
• Cookie Consent Management and Compliance
• Breach Notification Workflow and Reporting
• Privacy Policy Generation and Versioning
• Regulatory Change Monitoring with Impact Alerts
• Connectors for Enterprise System Integration
• Compliance Evidence Export for Regulator Audits

Automated Data Discovery and Classification

• Which data repositories should the platform scan for personal data (cloud object storage, file shares, analytics warehouse, databases)? Options: Cloud object storage, Network file shares, Relational/databases, Data warehouse/analytics, Email/archive stores, Other
• How many distinct systems or connector endpoints do you estimate need discovery (count each database, file share, cloud bucket, and SaaS tenant separately)? Options: 1-5, 6-20, 21-50, 51-200, 200+
• Do you require sensitive-data taxonomies beyond standard personal data categories (for example: health diagnoses, payment card data, or employee compensation fields)? Options: Yes, No
• Who will own verification and remediation of discovery results in your organization (for example: privacy team, IT system owner, security operations)? Options: You (privacy team), You (IT/system owner), Shared responsibility (privacy + IT), We implement and hand off
• When you accept discovery work, what automated classification precision threshold should we target for personal data identification (precision measured on a sample of records)? Options: >= 98% precision, >= 95% precision, >= 90% precision, Custom threshold

Continuous Data Flow Mapping and PARs

• Which in-scope processing activities must appear in processing activity records (PARs) (examples: customer onboarding, payroll processing, analytics pipelines)? Options: Customer/consumer processing, Employee HR processing, Payment/financial processing, Clinical/patient data processing, Analytics/telemetry processing, Other
• How will you supply existing PARs or data inventory artifacts to the platform (CSV export, API feed from governance tool, document upload, or none)? Options: CSV or spreadsheet export, API connection to existing tool, Document upload (PDF/Word), No existing PARs
• Identify which jurisdictions and regulatory regimes must be represented in PARs (for example: EU (GDPR) processing records, US state privacy laws, HIPAA for health data). Options: EU (GDPR), US state privacy laws (CCPA/CPRA style), HIPAA/healthcare, Sector specific regulation, Other
• Indicate the required update cadence for PARs once mapping is enabled (for example: real-time, daily sync, weekly reconciliation). Options: Real-time / continuous, Daily, Weekly, Monthly, Ad-hoc/manual
• Specify the acceptance criteria that will confirm PAR coverage for go-live (for example: percentage of high-risk systems documented, count of processing activities with owners), including numeric targets.

DSAR Intake and Automated Fulfillment

• Which intake channels do you use for data subject access requests (DSARs) today (web form, email inbox, support portal, phone ticket)? Options: Web form/portal, Dedicated DSAR inbox, Support ticketing system, Phone/request by mail, Other
• How many DSARs do you handle monthly on average, and what peak volume should the platform be sized for? Options: 0-10 per month, 11-50 per month, 51-200 per month, 200+ per month
• Do you require automated data retrieval from specific stores as part of DSAR fulfillment (select all that apply: CRM exports, HRIS records, cloud object storage, analytics logs)? Options: CRM / customer data store, HRIS / employee data, Cloud object storage, Analytics/telemetry logs, Email/archive stores
• Who must review and approve DSAR responses before disclosure (privacy reviewer, legal counsel, data owner)? Options: You (privacy reviewer), You (legal counsel), You (data owner), Automated with exception review
• Specify the SLA target for DSAR response that you must meet for regulatory compliance (number of calendar days from intake to response). Options: 7 days, 14 days, 30 days, Custom
• What acceptance criteria will validate DSAR automation readiness (for example: percent of requests auto-fulfilled within SLA on a representative sample, approved redaction templates)?

Consent and Preference Center Integration

• Which customer-facing surfaces must reflect consent and preference state (your public website domains, mobile apps, email subscription lists, call center systems)? Options: Public website domains, Mobile applications, Email marketing lists, Call center/CRM displays, Other
• How will preference changes be propagated to downstream systems (API/webhook, batch file export, message bus, manual update)? Options: API / webhook, Batch file export, Message bus / event streaming, Manual update by team
• Do you need the platform to surface consent capture records mapped to specific legal bases (for example: GDPR consent, contract necessity, legitimate interest)? Options: Yes, No
• Who will own the mapping between preference keys and system fields in your source CRM or marketing system? Options: You (privacy team), You (IT/system owner), Shared (privacy + IT), We implement mapping
• Specify any retention or legal hold constraints tied to consent changes (for example: retain proof of consent for X years, do not delete while subject to investigation). Options: Retain proof for 1 year, Retain proof for 3 years, Retain proof for 7 years, Custom

Privacy Impact Assessment Workflow and Templates

• Which PIA/DPIA templates should be available out of the box (for example: GDPR DPIA for new product, HIPAA risk assessment for patient data flows)? Options: GDPR DPIA (new processing), HIPAA risk assessment, Standard vendor integration PIA, Custom template import
• How should PIA risk be scored in your workflow (qualitative low/medium/high, numeric score threshold, or custom scoring matrix)? Options: Low/Medium/High qualitative, Numeric scoring threshold, Custom scoring matrix
• Do you require automated routing of PIA reviews to specific approvers based on risk level (for example: legal review required for high-risk PIAs)? Options: Yes, No
• Who is the final approver for completed PIA documents within your organization? Options: You (privacy officer), You (legal counsel), You (business owner), Other
• Provide any existing PIA or DPIA documents you want imported as templates and note file format (PDF, Word, or structured JSON). Options: PDF, Word, Structured JSON, No existing templates

Vendor and Third-Party Data Inventory

• Which vendor categories should be inventoried and assessed (cloud service providers, analytics vendors, HR/payroll, payment processors, contractors)? Options: Cloud/service providers, Analytics vendors, HR/payroll vendors, Payment processors, Contractors/consultants, Other
• How many third parties/vendors should be onboarded into the inventory during the initial rollout? Options: < 50, 50-200, 201-500, 500+
• Do you require automated DPA (Data Processing Agreement) status tracking and expiration alerts for vendors? Options: Yes, No
• Who will be responsible for providing vendor contract documents and contact points for vendor onboarding? Options: You (procurement/legal), You (vendor management), You (privacy team), We assist in collection
• Identify the minimum vendor risk scoring threshold that should trigger remediation or escalation (for example: medium or above). Options: Medium and above, High only, Custom numeric threshold, No automated escalation

Cookie Consent Management and Compliance

• Which website domains or subdomains require cookie consent configuration and localized banners?
• Which cookie categories should be presented to users (functional, analytics, advertising, security)? Options: Functional, Analytics, Advertising/marketing, Security, Other
• Do you need automated cookie scanning and classification for third-party tags on each domain on a recurring cadence? Options: Yes, continuous scanning, Yes, weekly scan, Yes, monthly scan, No scanning required
• Who will approve cookie banner copy and consent language for each jurisdictional variant (for example: EU vs US privacy notices)? Options: You (privacy team), You (legal), You (marketing/team), Shared approval
• Specify any cookieless or restricted tracking requirements for specific jurisdictions or user cohorts (for example: disable advertising cookies for EU visitors).

Breach Notification Workflow and Reporting

• Which detection sources should feed the breach workflow (security incident reports, SOC alerts, user reports, third-party vendor notices)? Options: SOC/ SIEM alerts, Security team reports, User/customer reports, Third-party notifications, Other
• How quickly must notifications be prepared for regulators after a confirmed breach (for example: 72 hours for a regulator notification, internal escalation within X hours)? Options: Within 24 hours, Within 72 hours, Within 7 days, Custom timeline
• Who in your organization is the incident response owner that will accept and act on breach workflow tasks? Options: You (security/IR lead), You (privacy officer), You (legal counsel), Shared responsibilities
• Which notification artifacts must be generated automatically for an incident (investigation timeline, affected data categories, regulator report packet, impacted subject list)? Options: Investigation timeline, Affected data categories, Regulator report packet, Affected subject list, Remediation plan
• Specify the acceptance criteria that will confirm breach workflow readiness (for example: tabletop exercise completed with documented outputs, notification templates approved by legal).

Privacy Policy Generation and Versioning

• Which types of policies should the platform generate and version (consumer privacy notice, employee privacy notice, data processing agreements, cookie policy)? Options: Consumer privacy notice, Employee privacy notice, Data processing agreement template, Cookie policy, Other
• How many language localizations are required for each public-facing privacy notice? Options: 1 (English only), 2-5, 6-15, 16+
• Do you require automated publication of approved policy versions to your website or intranet via an API or static export? Options: API publication to website, Static export for web team, Manual publication by you, Both API and static
• Who must sign off on final policy versions before publication (privacy officer, legal counsel, executive sponsor)? Options: You (privacy officer), You (legal counsel), You (executive sponsor), Other
• Provide any existing privacy policy text or standard clauses you expect to be imported for baseline generation. Options: Provide policy text file, No existing text to import

Regulatory Change Monitoring with Impact Alerts

• Which jurisdictions should the monitoring cover (list countries, US states, and sector regulations you care about)?
• Which roles in your organization should receive impact alerts for new or changed regulation (privacy officer, legal, product owners, IT security)? Options: Privacy officer, Legal team, Product owners, IT/security, Executive sponsor
• How should regulatory impact be prioritized for you (for example: high impact on data transfers, new consumer rights, fines/exposure)? Options: High / Medium / Low impact labeling, Numeric impact score, Custom priority mapping
• When a regulation change is detected, which downstream actions should be created automatically (ticket in your ITSM, email to owners, schedule PIA)? Options: Create ITSM ticket, Email owners, Schedule PIA/DPIA, Create legal review task
• Indicate reporting cadence for summarized regulatory changes (daily digest, weekly summary, monthly review). Options: Daily digest, Weekly summary, Monthly review, Ad-hoc only

Connectors for Enterprise System Integration

• Which enterprise systems require connectors for this engagement (your CRM, HRIS, cloud object storage, analytics warehouse, ticketing system)? Options: CRM (customer data), HRIS (employee data), Cloud object storage, Analytics/data warehouse, Ticketing/ITSM system, Other
• How many connectors must be delivered in the initial phase to meet your go-live objectives (provide a numeric target)? Options: 1-5, 6-15, 16-50, 50+
• Which integration authentication methods will you provide for connector development (API keys, OAuth2, service accounts, database credentials)? Options: API keys, OAuth2, Service account / managed identity, Database credentials, SFTP / file drop
• Do you require agent-based discovery for on-prem systems or can all integrations be API/db-level? Options: API/db-level only, Agent-based for on-prem required, Hybrid
• Identify minimum connector coverage required for acceptance of this scope (for example: connectors covering X% of user-facing systems or N named systems).

Compliance Evidence Export for Regulator Audits

• Which regulatory audit packages must be supported at go-live (for example: GDPR evidence pack, US state privacy response pack, HIPAA audit dossier)? Options: GDPR evidence pack, US state privacy response pack, HIPAA audit dossier, Custom audit package
• What export formats do you require for evidence packs (PDF consolidated dossier, CSV logs, structured JSON for regulator portals)? Options: PDF dossier, CSV exports, Structured JSON, Other
• Who must approve and sign off on exported audit packages before submission to a regulator? Options: You (privacy officer), You (legal counsel), You (compliance lead), Other
• How far back must exported evidence cover for a regulator request (for example: last 6 months, 12 months, since policy change)? Options: Last 3 months, Last 6 months, Last 12 months, Since specified date

• Master Services Agreement (MSA)
• Statement of Work (SOW)
• Subscription Order Form
• Data Processing Agreement (DPA)
• Service Level Agreement (SLA)
• Implementation & Rollout Responsibilities Annex
• Acceptance Test Plan
• Change Order Agreement
• Regulatory Compliance Addendum

• Go-live Health Check (Week 1-4)
• First Measurement Review (Week 4-10)
• Acceptance Gate — Outcome Validation (Day 90)
• Quarterly Success Review (Ongoing quarterly)

• Run a quarterly verification checklist for connectors, classification jobs, DSAR workflow success, and archive results.
• Produce a documented acceptance decision tied to each acceptance criterion recorded in Solution Scope.
• For any unmet criteria, agree a remediation plan with clear verification steps and target resolution dates.
• Ensure all outcome evidence is archived in the shared workspace for future audits and regulator review.
• Publish the acceptance decision record with pass/fail status for each criterion and attach evidence used in the decision.
• Open remediation tickets for failed or conditional criteria with defined verification checks and deadlines.
• Schedule a follow-up verification session to confirm remediation completion if any criteria were conditional or failed.
• Trend review of core metrics
• Confirm core metrics for data map coverage and DSAR SLA compliance remain within accepted ranges or document remediation plans.
• Close low-severity operational items and prioritize the enhancement backlog for the next quarter.
• Ensure a clear verification method exists for each resolved issue to prevent regression.
• Update the operational dashboard with the quarter's metrics and notify stakeholders of any items outside accepted ranges.
• Publish prioritized enhancement requests with acceptance criteria and expected delivery quarter.
• Reconfirm committed success criteria and owners
• Confirm that core integrations and classification jobs are operational and producing ingestion counts.
• List and prioritize all go-live blockers with agreed remediation tasks and verification dates.
• Verify basic user onboarding progress and identify any training gaps that could impede early use.
• Publish a short go-live validation summary including connector status, initial ingestion counts, and identified blockers.
• Execute remediation actions to clear critical blockers and schedule verification calls as needed.
• Circulate a training completion roster and a plan to close any onboarding gaps within two weeks.
• Present first measurement data against targets
• Determine whether percentage of data map coverage and DSAR SLA compliance rate are trending toward the targets recorded in Solution Scope.
• Identify root causes for each metric gap and document corrective actions with deadlines.
• Confirm the verification plan and date for the Acceptance Gate meeting.
• Produce a metric roll-up showing current vs target for data map coverage, DSAR SLA compliance, median DSAR closure time, and number of onboarded data sources.
• Create a remediation tracker with tasks, acceptance checks, and completion dates for all items required before the acceptance gate.
• Schedule targeted technical or process detailed review sessions for any high-impact root causes identified.
• Restate acceptance criteria and numeric targets
• Deployment and integration validation
• Present outcome data for each acceptance criterion
• Recurring operational health checks
• Diagnose gaps and root causes
• Open issues and enhancement backlog
• Agree corrective actions and owners
• Early adoption signals and training status
• Document pass or fail per criterion and capture the acceptance decision
• Confirm timeline to acceptance gate
• Agree remediation plan for any failed or conditional items
• Agree operational actions and verification steps
• Open issues and defect triage
• Agree immediate remediation actions and timeline