Home / Case studies / CASE 03 · RISK & GOVERNANCE
CASE 03 · RISK & GOVERNANCE
A 50% readiness score conceals the actual exposure.
A fictional organization’s personal-data inventory becomes a prioritized control backlog. The point is to test obligations and ownership, not to declare compliance with a single score.
Evidence status. This is a synthetic governance exercise. The 50% score is a constructed internal rubric, not an official DPDP compliance score, certification or legal assessment. Control items and activity names are fictional.
context
The situation
A growing learning-platform provider handles data for customers, employees, marketing prospects and support contacts. Business owners know that privacy obligations matter, but have no single operational picture of where personal data is collected, why it is processed, what notice or lawful basis applies, who can access it, and when it should be deleted.
The management challenge is to turn a broad mandate into traceable action by processing activity, control owner and deadline rather than produce a reassuring aggregate heat map.
diagnosis
The diagnosis
A sample rubric scores five fictional processing activities, then groups missing controls by priority. The composite result is 50%, but the distribution matters far more than the average.
The 23% marketing score should trigger targeted review of consent or other lawful processing grounds, notice, data-sharing, retention and withdrawal journeys. But the number does not itself establish a legal violation; it only prioritizes deeper evidence collection.
intervention
The governance intervention
Convert data inventory to a control-evidence system. Each processing activity should connect purpose, data category, data principal, actor, processor, retention, sharing, security controls, lawful ground, complaints handling, and accountable owner.
- Inventory: map the process rather than count applications; one system can support several processing purposes.
- Obligation mapping: have qualified legal and compliance teams determine applicability, transitional timing, and evidence required.
- Gap register: give each failed control an owner, remediation action, dependency, target and residual risk decision.
- Independent closure: retest with evidence such as a working deletion request, access review, contract, log or incident drill.
findings
What the sample actually shows
The inventory reveals heterogeneity. Payroll sits at 86% under the fictional rubric while marketing and product journeys have substantially lower control evidence. An organization-wide average masks the critical paths and prevents effective remediation sequencing.
The scoring model can help organize a conversation, but only a traceable register links that conversation to testable control closure. A low score is a review signal, not a verdict; a high score is not legal safe harbor.
Readiness is a portfolio of documented obligations and working controls, not a single percentage.
decision
The management recommendation
Recommended next decision — not delivered compliance: assign executive ownership for all ten fictional priority-1 gaps; validate actual legal applicability; fund the high-dependency controls first; and schedule control retesting followed by a rehearsed incident drill.
| Gate | Acceptance evidence |
|---|---|
| Ownership | Every activity has a business owner and accountable control owner |
| Rights | Documented notice and tested request-handling workflow as applicable |
| Retention | Approved schedule with deletion or cessation evidence as applicable |
| Security | Access reviews, incident logs, third-party assurance and rehearsal results |
These criteria are a suggested operating checklist; legal interpretation belongs to qualified counsel and the relevant authorities.
limits
What this case does not prove
- 50% is not a recognized regulator-issued DPDP compliance score.
- Counts and classifications are invented; no real entity or data processing was assessed.
- No legal conclusions, certification, or readiness completion are asserted.
- Obligations and commencement dates should be verified against current official law and rules before implementation.
sources
Evidence and further reading
ReadSigil: synthetic readiness work sample · Original fictional assessment (PDF) · ReadSigil: DPDP readiness field note
The field note is educational and not a substitute for an up-to-date legal assessment.