Let's Start: Your Current Privacy Playbook

• Who on your team owns privacy operations day-to-day, and how would you describe their bandwidth right now? Options: Chief Privacy Officer / Head of Privacy, Data Protection Officer (DPO), VP/Head of Legal, Security/Compliance Lead, Cross-functional team, No single owner / rotating
• Which core privacy processes are you currently managing manually (please select all that apply)? Options: Data inventories / processing records, DSAR intake & fulfillment, Vendor/third-party inventories, Privacy impact assessments / DPIAs, Consent and preference management, Regulatory change monitoring, None — mostly automated
• Describe the single biggest manual step that consumes your team’s time today (examples: spreadsheets, email triage, custom scripts).
• Which systems and integrations hold the majority of your personal data (select the most relevant to give us a sense of scope)? Options: CRM (Salesforce, HubSpot), HRIS / Payroll, Marketing platforms (email, ads), Cloud storage (S3, GCS), Data warehouses / lakes, EHR / patient systems, On-prem apps, Other
• Roughly how many unique data sources or systems are in scope today (ballpark estimate is fine)? Options: Fewer than 10, 10–25, 26–75, 76–200, 200+

Are You Comfortable With 'Manual' Being Your Default?

• If your compliance workflow stayed manual for the next 12 months, what specific regulatory or business risks would you expect to materialize?
• How often have manual processes caused a missed deadline or near-miss with a regulator or customer (select best fit)? Options: Never, Rarely (once every few years), Occasionally (once a year), Regularly (multiple times/year), Frequently — systemically
• When those incidents happen, who absorbs the fallout and how does it typically show up (fines, escalations, product delays, executive time)?
• How does it feel for your team to do compliance work today—overwhelmed, in control, stretched thin, defensive, or something else? Options: Overwhelmed, Stretched thin but coping, Reactive and defensive, Generally in control, Optimistic / proactive
• What would have to change about your current operations for you to feel confident facing a regulator’s audit tomorrow?

Where Do Your Data Maps Really Break?

• When you look at your data map right now, how confident are you that it reflects reality across systems and geography? Options: Highly confident, Mostly accurate, Patchy — some gaps, Routinely out of date, We don't have a single source of truth
• What parts of your data mapping feel 'fictional' or especially brittle—schema definitions, field-level lineage, cross-border transfers, or third-party flows? Options: Field-level lineage, Cross-border transfers, Vendor data sharing, System-level inventories, Purpose/context for processing, Retention & deletion practices
• Tell us about the last time a system or process change broke your map—what happened, how long did it take to detect, and who fixed it?
• Who is responsible for updating the map when products or integrations change, and how is that request tracked today? Options: Privacy team updates, Engineering/DevOps owns updates, Product manager owns updates, Ad-hoc requests via ticketing, No formal owner
• How long does it typically take to reconcile a newly discovered data flow from detection to documented mapping? Options: <1 day, 1–3 days, 4–14 days, 2–6 weeks, Unclear / varies widely

What Keeps You Up at Night About DSARs?

• When a data subject access request arrives, where does the process begin and what are the first three handoffs?
• How predictable is your DSAR volume and composition (e.g., access, deletion, portability) over the last 12 months? Options: Very predictable, Somewhat predictable, Spiky but manageable, Unpredictable / increasing rapidly
• What bottleneck delays DSAR fulfillment most often—identifying records, getting engineering help, vendor data pulls, legal review, or something else? Options: Identifying records, Engineering/IT support, Vendor responses, Legal review/approval, Manual redaction, Other
• Have you ever simulated a DSAR SLA (time-to-respond) and measured whether each owner could meet it under realistic load? If so, what did you learn? Options: We simulate regularly and pass, We simulated and found gaps, We attempted once, We have not simulated
• What is the worst-case outcome you fear if a DSAR is mishandled (regulator penalty, breach, reputational damage, contractual loss)? Rank the top two. Options: Regulatory penalty, Reputational harm, Civil litigation/customer suits, Contractual non-compliance, Operational disruption

How Confident Are You About Third-Party Data Sharing?

• If I asked for a current inventory of all third parties processing personal data for you, how complete would your list be? Options: Comprehensive and current, Mostly complete with some gaps, Incomplete but usable, Fragmented across teams, We don't maintain a consolidated inventory
• Which vendor categories are most opaque to you today (analytics, cloud hosting, marketing, payroll, subcontractors)? Options: Analytics/ads, Cloud/infra, Marketing platforms, HR/payroll, Customer support vendors, Subprocessors of processors, Other
• Do you have contractual controls and evidence (DPIAs, SOC reports, data processing addenda) standardized and easily retrievable for each vendor? Options: Yes — centralized and searchable, Partially — some vendors, No — stored in silos, No formal documentation
• Have you ever discovered undeclared vendor sharing during an audit or incident? How was it handled and how long until it was closed?
• What would make you comfortable that your vendor map is audit-ready at any moment—automated attestations, periodic rescans, or executive sign-off? Options: Automated attestations, Periodic rescans, Contract & evidence repository, Dedicated vendor risk manager, Executive attestation cadence

Imagine a Day When Compliance Feels Predictable

• Close your eyes and imagine your privacy program a year from now—what one metric or outcome would tell you the transformation worked? Options: DSAR SLA attainment, Percentage of auto-discovered data mapped, Reduction in manual hours, Time-to-respond to audits, Number of regulatory issues
• Which features or capabilities would shift the most effort off your plate—automated discovery, mapped lineage, DSAR orchestration, vendor attestations, or compliance reporting? Options: Automated discovery & classification, Field-level lineage & data maps, DSAR orchestration & automation, Vendor inventory & attestations, Audit-ready reporting and evidence packs
• How would your stakeholders (legal, engineering, product, executive) measure success if the program delivered that outcome? Options: Reduced risk exposure, Operational efficiency, Faster product launches, Lower compliance costs, Stronger regulator relationships
• What behavioral change would you want to see in the next 3 months to know adoption is real (e.g., fewer ad-hoc requests to engineers, engineers using an automated tool, legal minimizing manual reviews)?
• If a pilot could prove the value in a single domain (DSARs, vendor mapping, or discovery), which would you choose and why? Options: DSAR automation, Automated discovery & mapping, Vendor inventory & risk, Consent & preference center

What Would It Take to Make This Change Stick?

• What's the single biggest internal obstacle to adopting a new privacy platform—budget, people, integration effort, executive buy-in, or competing priorities? Options: Budget / procurement, Engineering capacity / integrations, Lack of executive sponsorship, Org change resistance, Legal/regulatory uncertainty
• Who would need to be involved in a decision and implementation (names or roles), and who is the likely champion?
• What timeline feels realistic for a pilot to demonstrate value and for you to reach a go/no-go decision? Options: 2–4 weeks, 1–2 months, 3–6 months, 6+ months
• What acceptance criteria would you require to call a pilot successful (e.g., % of DSARs automated, reduction in manual hours, mapping coverage)? Please list measurable targets if possible.
• How should we report progress to you during a pilot—weekly demos, automated dashboards, executive summaries, or joint retrospectives? Options: Weekly demos, Automated dashboards, Executive summaries, Joint retrospectives
• Beyond product, what support would increase your confidence—implementation playbooks, integration engineers, regulatory evidence templates, or a dedicated success manager? Options: Implementation playbook, Integration engineers, Regulatory evidence templates, Dedicated success manager, Training for operators

• Solution Experience Kickoff — Confirm Current State & Consequence
• Data Map Scenario — Live Data Discovery & Mapping
• DSAR Volume & SLA Simulation — Process Proof & Audit Trail
• Vendor Sharing & Third‑Party Data Flow Scenario
• Consolidation & Validation — Signoff on Future State and Acceptance Criteria

• Agree on vendor ingestion cadence and owners for ongoing maintenance.
• Seller to propose connector configuration and schedule for full discovery.
• Confirm DSAR Types & SLAs
• Prove the platform can meet target DSAR SLAs under realistic volumes.
• Show reductions in manual triage and estimated FTE/time savings.
• Confirm the audit trail and evidence output meet the customer's regulator expectations.
• Obtain explicit customer validation that the simulated flows address their key DSAR pain points.
• Seller to deliver a side‑by‑side SLA performance and FTE effort comparison document.
• Customer to review and sign off on the audit evidence samples for regulatory sufficiency.
• Seller to propose DSAR playbook templates and configurable SLA escalation rules.
• Recap Vendor Risk Objectives
• Validate that the platform accurately maps third‑party data flows to processing activities.
• Demonstrate the platform's ability to surface vendor gaps and manage remediation at scale.
• Confirm that generated vendor evidence meets the customer's regulator audit requirements.
• Introductions & Objectives
• Seller to provide a vendor gap analysis and recommended remediation plan.
• Customer to identify vendor owners and provide missing contract artifacts within the agreed timeline.
• Seller to configure a sample remediation workflow and schedule a review session.
• Summary of Findings Against Acceptance Criteria
• Obtain explicit customer validation that the platform achieves the defined future state and acceptance criteria.
• Document outstanding risks and assign owners to closure tasks.
• Agree on next steps and timeline to progress to Solution Scope and Mutual Commit.
• Seller to deliver a consolidated evidence binder mapping artifacts to acceptance criteria.
• Customer to provide formal signoff or a list of remaining objections within 5 business days.
• Seller to produce a proposed Scope and commercial outline based on validated requirements.
• Elicit a crystal‑clear current state in one sentence.
• Quantify the consequence of the current state in operational or regulatory terms.
• Define an outcome‑focused future state and measurable acceptance criteria.
• Confirm required customer artifacts and access for the upcoming scenario walkthroughs.
• Customer to deliver sample data inventory extract, recent DSAR metrics, and vendor list before the next meeting.
• Seller to prepare a one‑page experience plan mapping each scenario to acceptance criteria.
• Schedule the scenario walkthroughs and assign owners for each pre-work item.
• Recap Current State & Acceptance Criteria
• Demonstrate that automated discovery creates a data map that matches or improves the customer's inventory.
• Surface gaps that would have otherwise required manual reconciliation and quantify impact.
• Validate scope, connectors, and classification accuracy with customer owners.
• Agree on remediation tasks and ownership to meet acceptance criteria.
• Seller to provide a discrepancy report mapping automated findings to the customer's inventory.
• Customer to assign a data owner to validate classification samples within 5 business days.
• Intake & Triage Simulation
• Inventory Ingestion & Normalization
• Open Issues & Risk Register
• Live Discovery: Scope & Run
• One‑Sentence Current State
• Data Flow Linkage & Evidence
• Consequence Calibration
• Automated Search & Response Assembly
• Mapping Output & Validation
• Customer Validation & Signoff Questions
• Tie Findings Back to Consequence
• Define Future State Outcomes
• Control Simulation & Remediation Workflow
• SLA Stress Test & Timeline Comparison
• Define Next Steps: Scope, Commercial, and Deployment Readiness
• Audit Trail & Evidence Package
• Specify Success Criteria & Acceptance
• Force Validation
• Audit Use Case: Regulator Inspection
• Schedule Follow‑Up Deliverables
• Validation & Next Steps

• Deploy automated data discovery and classification
• Deploy live data flow mapping and processing records
• Implement DSAR intake portal and fulfillment automation
• Automate DSAR response packaging and compliance exports
• Integrate consent and preference center with systems
• Onboard vendor third‑party data inventory and sync
• Deploy PIA templates and automated workflows
• Deploy cookie consent management and CMP integration
• Configure breach notification workflow and regulator filing
• Generate and version privacy policies for publication
• Activate regulatory change monitoring with impact alerts
• Implement enterprise connectors (CRM, Cloud, HRIS, S3)

Deploy automated data discovery and classification

• Which data locations should automated discovery scan? Options: On-premise file servers, Cloud storage (S3, GCS, Azure Blob), Databases (SQL/NoSQL), Endpoints (laptops, servers), SaaS apps (Salesforce, Google Workspace), Email systems, Other
• Approximate total data volume to be scanned (raw storage size)? Options: Less than 100 GB, 100 GB - 1 TB, 1 TB - 10 TB, 10 TB - 100 TB, 100 TB+
• Which data types and file formats require classification? Options: Structured (databases), Unstructured (documents, PDFs, emails), Images, Audio/Video, Logs/Telemetry, Other
• Do you have an existing sensitivity taxonomy or labels to apply (PII, PHI, Confidential, Public)? If yes, please summarize or upload. Options: Yes - I will provide taxonomy, No - need standard taxonomy, No - need custom design
• What discovery cadence do you require for different stores? Options: Continuous / near real-time, Daily, Weekly, On-demand/manual
• What performance/accuracy thresholds must classification meet (precision/recall or false positive tolerance)? Options: Min 90% precision, Min 95% precision, Min 90% recall, Custom / will define
• Are there any datasets, repositories, or document types to exclude from discovery?

Deploy live data flow mapping and processing records

• Which processing activities or systems should be included in the live data flow map? Options: Customer-facing systems, HR/employee systems, Marketing systems, Payment systems, Third-party transfers, Other
• Do you currently maintain processing activity records (PAR/PAC) or legacy data maps? Options: Yes - structured inventory, Yes - spreadsheets, No - starting from scratch
• Which jurisdictions and regulatory frameworks must flows reflect (e.g., GDPR, CCPA/CPRA, HIPAA, state laws)? Options: GDPR, CCPA / CPRA, HIPAA, US State privacy laws, Other (please specify)
• What integration level do you want between discovery results and live flow mapping (automated sync, manual review, hybrid)? Options: Automated sync with suggested mappings, Hybrid - automated suggestions + manual approval, Manual mapping only
• Who are the internal owners/stakeholders for validating processing records (roles or teams)?
• Do you need lineage and transformation tracking (e.g., where data is transformed, aggregated, or pseudonymized)? Options: Yes - full lineage, Partial - critical flows only, No
• Are there contractual or policy constraints to show on maps (data residency, restricted transfers, DPA clauses)? Options: Yes - provide list, No

Implement DSAR intake portal and fulfillment automation

• Which intake channels do you want to enable for DSARs? Options: Web portal/Form, Email intake, Phone intake (manual), API intake from other apps, Physical mail (scan)
• What types of data subject requests must be supported (access, rectification, deletion, portability, restriction, objection)? Options: Access, Rectification, Deletion/Erasure, Portability, Restriction of processing, Objection
• Which identity verification and proof steps are required per jurisdiction or request type? Options: Email verification, Two-factor (SMS/app), ID document upload, Knowledge-based questions, No verification required
• What are your expected DSAR volumes (monthly and peak) by subject type (consumer, employee, patient)? Options: <10/month, 10-100/month, 100-1,000/month, 1,000+/month
• What SLA goals should the intake and initial triage meet (e.g., acknowledge within X hours)? Options: Acknowledge within 24 hours, Acknowledge within 72 hours, Custom SLA
• Do you require multilingual intake and user-facing communications? If yes, which languages? Options: Yes - provide languages, No
• Are there existing legal templates, approvals, or playbooks to integrate into automated triage? Options: Yes - will provide, No - need templates from vendor

Automate DSAR response packaging and compliance exports

• What export formats are required for responses and regulator evidence packages (PDF, CSV, ZIP, EDRM)? Options: PDF, CSV/Excel, ZIP with file structure, EDRM/Other
• Do responses need redaction, privileged content detection, or sensitivity masking before delivery? Options: Redaction required, Privileged detection required, Masking/anonymization required, None required
• What audit and chain-of-custody requirements do regulators expect for exported packages? Options: Signed evidence logs, Access logs & reviewer attestations, Hashing/checksums, Other
• Do you require automated bundling rules (e.g., include only relevant systems, limit per-request size)? Options: Yes - configure rules, No - manual packaging
• Which delivery channels should be supported for fulfilling DSARs (secure portal, encrypted email, physical delivery)? Options: Secure portal download, Encrypted email, SFTP transfer, Physical mail
• Do you need role-based approvers or legal review gates before export? Options: Yes - require approvers, Optional, No
• Are data minimization or contextualization notes required to accompany exports for regulators? Options: Yes - include explanatory notes, No

Integrate consent and preference center with systems

• Do you currently have a preference or consent center in production? Options: Yes - vendor provided, Yes - custom built, No - need new
• Which channels need consent sync (web forms, mobile apps, CRM, email, ad platforms)? Options: Website/web forms, Mobile apps, CRM (Salesforce, HubSpot), Email service providers, Ad platforms, Other
• Which CMPs or consent vendors (if any) must we integrate with? Options: OneTrust, Cookiebot, Custom CMP, Other, None
• Do you require consent-to-processing lineage (linking consent to specific processors/purposes)? Options: Yes - full lineage, Partial, No
• How should preferences be stored and surfaced to downstream systems (real-time API, nightly sync, SFTP)? Options: Real-time API, Scheduled sync (hourly/daily), Batch export, Other
• Are there specific legal bases or purpose categories that must be supported per jurisdiction?
• Do you need a user-facing preference center with self-service controls and audit trail? Options: Yes - public facing, Yes - internal admin only, No

Onboard vendor third‑party data inventory and sync

• Approximately how many third-party vendors/processors should be onboarded initially? Options: <50, 50-200, 200-1,000, 1,000+
• What attributes do you track for vendors today (data types processed, data flow direction, country, contractual clauses)? Options: Data types processed, Transfer locations/countries, Contract status/DPA, Security posture, Sub-processors, Other
• How will vendor inventories be provided for import (spreadsheet, API, procurement system)? Options: Spreadsheet/CSV, API connector (procurement), Manual entry through UI, Other
• Do you require automated sync with vendor portals or attestations (e.g., scan for DPAs, SOC reports)? Options: Yes - automated sync, Periodic manual refresh, No
• Do you want vendor risk scoring and continuous monitoring included? Options: Yes - include scoring, No - inventory only, Optional
• Are there regulatory requirements to demonstrate vendor due diligence in specific jurisdictions? Options: Yes - list jurisdictions, No
• Should vendor data sharing be mapped to processing records and DSAR workflows? Options: Yes - map automatically, Hybrid - manual links, No

Deploy PIA templates and automated workflows

• Which types of processing require PIAs (new systems, high-risk processing, profiling, health data)? Options: New systems, High-risk profiling, Health data/PHI, Large scale processing, Other
• Do you have existing PIA templates or need vendor-provided templates mapped to laws? Options: Existing templates - will provide, Need standard templates from vendor, Need custom templates
• Who must be included in PIA review workflows (privacy, legal, security, business owner)? Options: Privacy/Legal, Security/IT, Business owner, Data Protection Officer, Other
• What approval SLAs and escalation paths are required for PIAs? Options: 7 business days, 14 business days, Custom SLA
• Do you require automated controls recommendations and mitigation tracking within PIAs? Options: Yes - auto recommendations, No - manual only, Partial
• Should completed PIAs be linked to processing records and vendor profiles automatically? Options: Yes - link automatically, Manual linking, No
• Are there reporting or audit exports required for PIAs for regulators or internal committees? Options: Yes - predefined reports, Custom exports needed, No

Deploy cookie consent management and CMP integration

• How many websites and subdomains require cookie scanning and consent banners? Options: 1, 2-10, 11-50, 50+
• Which CMPs or tag managers are you using (if any)? Options: OneTrust, Cookiebot, Google Tag Manager, Custom CMP, None
• Do you require automated cookie scanning and cookie categorization? Options: Yes - automated scan, Periodic/manual scan, No
• Should consent settings be synchronized to downstream systems and ad platforms? Options: Yes - real-time sync, Batch sync, No
• Do you need geo-targeted banners and consent flows for different jurisdictions? Options: Yes - by country/state, No - single global banner
• Are there custom UI/brand requirements for banners and preference centers? Options: Yes - provide design, Use standard templates, No preference
• Do you require consent logs and evidentiary exports for regulator audits? Options: Yes - retain logs, No

Configure breach notification workflow and regulator filing

• What are your internal breach detection sources to integrate (SIEM, DLP, IDS, SOC tickets)? Options: SIEM, DLP, IDS/IPS, Incident tickets, Other
• Which jurisdictions' breach notification laws must workflows satisfy (timing, thresholds)? Options: GDPR (72 hours), US State laws, HIPAA, Other - list
• What internal roles and escalation paths should be included (CISO, Legal, Data Protection Officer)? Options: CISO/InfoSec, Legal, DPO/Privacy, Communications/PR, Other
• Do you require automated regulator filing templates and evidence bundling per jurisdiction? Options: Yes - auto templates, Partial - templates only, No

• Non-Disclosure Agreement (NDA)
• Master Services Agreement (MSA)
• Statement of Work (SOW)
• Service Level Agreement (SLA)
• Data Processing Agreement (DPA)
• Pricing & Payment Schedule
• Implementation & Acceptance Plan
• Integration & Access Authorization
• Security & Compliance Addendum
• Change Order & Scope Management
• Termination & Transition Agreement
• Regulatory Evidence & Audit Support Addendum

• Success Outcomes & Metrics Review
• Regulatory Evidence Package Review & Audit Handoff
• Operational Readiness & Continuous Improvement Cadence
• DSAR & Incident Simulation (SLA Validation)
• Executive Review & Roadmap Alignment

• Run a full DSAR simulation with timestamps recorded and produce a run book of lessons learned.
• Runbooks & SOP Review
• Put in place documented runbooks and defined operator responsibilities.
• Agree on monitoring thresholds, SLA reporting, and escalation paths.
• Establish a recurring governance and continuous improvement cadence.
• Create the shared communication channel and define triage procedures for issues and improvements.
• Publish final runbooks and link them in the shared channel with owners assigned.
• Configure monitoring alerts and schedule automated SLA reports to stakeholders.
• Create the shared Slack/Teams channel, define channel rules, and onboard participants.
• Schedule the recurring governance meetings and send calendar invites.
• Simulation Objectives & Success Criteria
• Prove the end-to-end DSAR and incident workflows meet SLA and evidence capture requirements.
• Identify any process or technical failure modes and assign remediation owners.
• Agree on retest criteria and timeline for closing critical issues.
• Opening & Objectives
• Create a prioritized remediation backlog with owners and completion dates.
• Plan and schedule a retest for any critical or high-severity failures.
• Executive Summary of Outcomes
• Secure executive buy-in on success metrics and the proposed roadmap.
• Obtain budgetary or formal commitments needed to continue or expand the engagement.
• Agree on communication plan and executive sponsors for ongoing governance.
• Deliver the executive summary deck and ROI figures to stakeholders and publish in the shared channel.
• Obtain formal approval or budget commitments for the agreed roadmap items.
• Announce executive sponsors and the communication plan to the broader stakeholder set.
• Validate that measured outcomes meet the pre-defined success criteria.
• Identify and prioritize any outstanding gaps that block formal acceptance.
• Assign owners and timelines for remediation and follow-up validation.
• Confirm a clear go/no-go decision or conditional acceptance with milestones.
• Produce a consolidated metrics & findings report (including trend charts) and distribute to stakeholders.
• List and prioritize top 5 evidence or operational gaps with owners and target dates.
• Schedule the follow-up verification meeting to confirm gap remediation.
• Meeting Intent & Scope
• Confirm the evidence package satisfies mapped regulatory requirements for targeted frameworks.
• Designate an evidence steward and storage/access model for audit retrieval.
• Establish sign-off criteria and a remediation path for any missing artifacts.
• Schedule a mock regulator run-through if gaps or stakeholder readiness issues remain.
• Finalize the evidence bundle index and upload canonical copies to the agreed secure repository.
• Apply integrity checks and document the retention & access policy for the repository.
• Assign the evidence steward and publish contact & responsibilities.
• If required, schedule a mock regulator Q&A and prepare the supporting artifacts.
• Evidence Inventory & Mapping
• ROI & Risk Reduction
• Current State Recap
• Dry-run Walkthrough
• Monitoring, Alerts & SLAs
• Sample Bundle Walkthrough
• Live Simulation Execution
• Roles, Training & Knowledge Transfer
• Open Risks and Residual Issues
• KPI Dashboard Review
• Continuous Improvement Cadence
• Regulatory Evidence Summary
• Roadmap & Options for Expansion
• Integrity, Retention & Access Controls
• Measurement & SLA Analysis
• Failure Mode Review & Remediation Plan
• Sign-off Criteria & Stewardship
• Gaps, Risks & Impact
• Decisions, Budget & Commitments
• Communication & Shared Channel Setup