When this is the right conversation
A privacy policy exists, but staff do not know where to send an access request, how a deletion propagates or which vendor holds the relevant records.
What the work involves
- Map the scoped information lifecycle and the business purposes associated with it.
- Work with your privacy lead and, where needed, counsel to translate approved requirements into operational tasks.
- Design request, incident-escalation, retention-review and disposal-evidence workflows.
- Walk through realistic scenarios with the responsible teams and record unresolved technical or legal questions.
What we need from your team
Your designated privacy lead, relevant system owners and access to legal advice where interpretation is needed. Do not send sensitive records through our inquiry form.
What useful completion looks like
A team can demonstrate who receives a request, which systems are in scope, who decides the response and what evidence is retained.
We provide operational consulting, not legal advice. Applicable federal, provincial, sectoral and contractual requirements must be confirmed for your circumstances.
Before we begin
We agree the business objective, named delivery roles, access arrangements, fee, timetable and acceptance criteria in a written scope. Dependencies and out-of-scope work stay visible. We do not assume permission to change production systems or transfer sensitive information.
See the engagement processRelated field notes
A privacy policy is not the operating process
One approved decision. Several places to carry it out.
A lifecycle decision may touch a source application, an export and a supplier-held copy. Start by identifying the records and the approved authority for the action. Map the operational steps, exception or hold checks, responsible roles and evidence needed to show what happened. Do not choose a retention period by copying a generic template.
Illustrative scenario, not a client case study or a claim of past results.
The working evidence
- Lifecycle mapCollection, use, sharing, retention, correction and disposal handoffs.
- Authority registerThe approved requirement or decision reference and its reviewing role.
- Operational playbookTrigger, validation, systems, responsibilities and escalation route.
- Exercise recordWhat was rehearsed, what failed, open questions and agreed corrective actions.
Who does what
The privacy or records lead and appropriate specialists determine the applicable requirements. Business owners confirm the use. Technical custodians establish what each system can actually do. Operational consulting translates the approved decisions into a workable process.
Run a tabletop exercise with fictional information. Locate each in-scope copy, identify unresolved exceptions and show how the authorised role would verify completion or escalate an incomplete action.
Backups, legal holds, retention duties and processor limitations require specific review. A flowchart does not prove deletion everywhere or determine legal obligations.
Make the first workshop useful.
Bring roles, questions and approved examples—not an unrestricted data export.
- Which approved request, access or retention workflow is being operationalised?
- Who provides the legal or policy authority for the required actions?
- Which systems, copies, dependencies and exceptions are within the review?