Treat the summary score as a diagnostic prompt, not assurance. Verify legal applicability, rank material control failures, assign owners and independently test closure before making any readiness claim.
01 / THE MANAGEMENT PROBLEM
A green gauge is not an answer to regulatory exposure.
Fictional Acme Learning has a personal-data inventory spanning customer signup, marketing campaigns, payroll, a learning app and support tickets. The assessment returns a 50% aggregate readiness score and 23 identified gaps, 10 labeled priority-one.
The actual decision: which obligations and processing activities create unacceptable residual risk, what evidence would demonstrate remediation and what must escalate to accountable management?
Chief operating / privacy leadership, with designated legal ownership.
Processing activity, purpose, systems, vendors and personal-data lifecycle.
Five example activities, illustrative scores, 23 unverified placeholder gaps.
50% is an internal exercise score. It has no standing as a legal compliance rating.
02 / THE DIAGNOSIS
The average hides activities that need direct attention.
Exhibit 1 · Illustrative activity-level scores
INTERNAL INDEX · NOT ASSURANCEDiagnostic questions before scoring
- Which personal data is collected, for what purpose, under which applicable legal basis and notice regime?
- What happens when a person exercises a right, corrects data or withdraws consent where relevant?
- Do retention, deletion and vendor-processing records exist and match practice?
- Is access restricted, is incident escalation rehearsed and are control owners named?
Applicable rules, commencement dates and exemptions must be confirmed against current official requirements. None of those legal conclusions can be inferred from the demonstration index.
03 / THE OPTIONS
Prioritize by obligation and exposure, not by the colour of a tile.
| Approach | Risk | Choice |
|---|---|---|
| Average all activity scores | Material gaps concealed | Reject |
| Fix easiest gaps to raise the percentage | Goodhart’s law: score rises, exposure remains | Reject |
| Rank mandatory obligations and exposure; record evidence and owners | Requires legal and operational judgment | Recommend |
| Procure a privacy tool immediately | Automation without defined controls | Defer until requirements are established |
04 / THE INTERVENTION
A gap register tied to real evidence.
Each issue should carry: obligation and applicability, processing activity, failure mode, affected records/individuals where known, severity, control owner, remediation owner, due date, compensating controls, validation method, closure evidence and exception approver.
- 01 · VERIFYLegal/privacy maps relevant provisions to processing activities and confirms each requirement’s commencement, exemption and applicability.
- 02 · TRIAGEIdentify prohibited or material residual-risk activities. Immediate control escalation outranks cosmetic score improvement.
- 03 · REMEDIATESystem and business owners fix notices, workflow, access, deletion, processor controls and incident playbooks as applicable.
- 04 · TESTIndependent control assurance samples records and events; evidence shows the control is operating, not merely documented.
- 05 · SUSTAINUse monthly closure review, overdue escalation, control failure triggers and an incident response drill.
05 / THE MEASUREMENT
Switch from “readiness %” to exposure, closure and assurance.
| Management measure | Correct denominator / evidence | Illustrative threshold |
|---|---|---|
| Mandatory control coverage | Applicable obligations with tested controls / applicable obligations | 100% for mandatory items |
| Critical overdue issues | Count and age by control owner | Zero overdue with unapproved exception |
| Evidence-backed closure | Independently validated fixes / fixes marked completed | 100% sign-off for closure |
| Deletion and rights processing | Eligible requests processed within verified applicable timelines | 100% of in-scope required cases |
| Incident preparedness | Drill observations with owners and retest | Material failures escalated and retested |
These are proposed management design tests, not current Acme performance or legal opinions. A control can be “implemented” without being effective; independently test both design and operating effectiveness.
06 / THE IMPLEMENTATION
Close the most material exposures first.
- WEEKS 01–02Privacy counsel validates applicability and obligations. Data/IT confirms processing inventory, processors and data flows. Risk team reclassifies all 23 example gaps rather than accepting the ten P1 labels as fact.
- WEEKS 03–06Operational owners remediate highest-risk verified controls, with management-approved temporary mitigations and evidence requirements.
- WEEKS 07–10Assurance team tests remediation, examines live samples and disputes closure without adequate evidence.
- WEEKS 11–12Conduct a scenario-based incident and rights-request rehearsal; publish issues, residual exposure and exceptions to accountable leadership.
Stop / escalate rule: do not declare readiness while a mandatory in-force control is unimplemented, a material breach path is unresolved or closure evidence cannot be reproduced.
07 / EVIDENCE LEDGER
What is observed in the sample, and what must be proved.
| Statement | Classification |
|---|---|
| Five activity-level indices, 23 gaps, ten P1 labels | Synthetic sample fields |
| The aggregate 50% demonstrates legal readiness | False inference; explicitly rejected |
| Named control owners and independent retesting | Recommended approach, not executed |
| All obligations and dates have been legally validated | Not claimed; requires current professional review |
Decision: prioritize verified control gaps with obligations, owners and independent evidence; retire the aggregate readiness gauge as the primary executive measure.
Underlying synthetic readiness report (PDF) ↗ · General DPDP readiness field note ↗