The first three months of a privacy program decide whether it becomes part of how the company runs or stays a side project with a policy page. The job in that window isn't to fix everything. It's to learn what you're dealing with, get the right people to own the risk, and show a few results.
This plan assumes you're the newly appointed privacy lead (or the counsel, security lead or engineer who just inherited privacy) at a company with no real program yet. Adjust the timings to your size. A 50-person startup can move through it faster than a regulated enterprise.
Days 1-30: establish context and obligations
Start with what the business is trying to do, not with the law. A privacy program that ignores the company's strategy will keep losing arguments to it. In the first month, find out:
- What the business does with personal data and why. Products, revenue model, the customer data that drives it, plans for the next year or two (new markets, AI features, acquisitions).
- Who the data is about. Consumers, business contacts, employees, patients, children. Each group pulls in different rules.
- Where you operate and whose data you touch. GDPR applies to processing linked to an EU establishment or to targeting or monitoring people in the EU. US state laws apply based on thresholds such as the number of residents' records you process or your revenue. Canada, Quebec, the UK and others have their own rules. The privacy regulators directory helps with the list.
- What you've already promised. Your privacy notice, customer contracts and DPAs, security questionnaires you've answered, certifications or attestations you hold or have committed to. These are obligations too, and they're often stricter than the law.
- What's already there. Security controls, an ISO/IEC 27001 certification or SOC 2 report, a vendor review process, an incident response plan. Privacy should build on these, not duplicate them.
The output of month one is an obligations register: each law, contract commitment and framework that applies, what it requires in practice, and who currently owns it (often nobody). Keep it in a spreadsheet. It will drive everything else.
Alongside it, start a lightweight data inventory. Don't try for a complete ROPA yet. List the 15-30 systems that hold the most personal data, with owner, data categories and main purpose. Data mapping and discovery explains how to grow this later, and the data map cost page explains what drives the effort of going further.
Map your stakeholders
Privacy work is done mostly by people who don't report to you. Map them early. For each one, write down what they care about and what they need from privacy:
| Stakeholder | What they care about | What you need from them |
|---|---|---|
| Executive team / board | Growth, risk, reputation, deal velocity | A risk owner, budget, decisions on risk appetite |
| Legal | Liability, contracts, regulatory exposure | Interpretation of laws, DPA templates, incident response role |
| Security | Threats, controls, audits | Shared controls, access reviews, breach detection |
| Engineering and data | Shipping, velocity, data access | System owners, deletion and export capability, privacy review in design |
| Product | Features, conversion, roadmap | Early notice of new data uses, especially AI and tracking |
| Marketing | Measurement, targeting, attribution | Cookie and tag ownership, consent and opt-out handling |
| Customer support | Ticket volume, satisfaction | Recognizing and routing privacy requests |
| HR | Employees, recruiting | Employee and candidate data practices |
| Procurement / finance | Cost, vendor terms | A privacy step in vendor onboarding |
Have a short one-to-one with each. Ask what they think the company's biggest privacy risk is. You'll learn more about the real data flows from these talks than from any document.
Frame privacy as risk for leadership
Senior leaders own business risk. Privacy gets attention, budget and decisions when it's put in the same terms as everything else they weigh. In practice:
- Put privacy risks in the enterprise risk register, using the same likelihood and impact scales as other risks. If there's no register, use the one security uses.
- Describe risks as business events. "We can't delete customer data from our analytics warehouse, so we can't honor deletion requests from about a third of our systems" is a risk statement. "We're not GDPR compliant" isn't.
- Connect privacy to revenue as well as penalties. Enterprise customers send privacy and security questionnaires. Slow or weak answers delay deals. This is often the most persuasive argument with a growth-stage leadership team.
- Ask for decisions, not sympathy. For each top risk, offer options: fix (with cost), mitigate, or accept. If leadership accepts a risk, record who accepted it and when.
- Get a named executive sponsor. The sponsor owns privacy risk at the top table and clears blockers. Without one, privacy work loses to every product deadline.
Work top-down and bottom-up at once. Leadership sets direction and owns risk, but adoption depends on the engineers, marketers and support agents who handle the data every day. Find a contact in each team who'll flag issues early.
Days 31-60: pick a framework
A framework gives the program a structure, a common vocabulary with security and audit, and a way to show progress. You don't need to certify against it in year one, but choose one to organize around.
| Framework | What it is | Good fit when |
|---|---|---|
| NIST Privacy Framework | A voluntary, outcome-based framework from the US National Institute of Standards and Technology. Version 1.0 (2020) is organized into functions: Identify-P, Govern-P, Control-P, Communicate-P and Protect-P. NIST published a draft version 1.1 in April 2025 that aligns it with the Cybersecurity Framework 2.0. As of this writing, NIST's site still lists 1.1 as a draft, so check for the final version. | You want a flexible structure and a maturity baseline with no certification, and your security team already uses the NIST Cybersecurity Framework. |
| ISO/IEC 27701 | An international standard for a privacy information management system (PIMS). The 2019 edition was an extension of ISO/IEC 27001. The revision published in October 2025 is a standalone management-system standard, so organizations can certify to it without first holding ISO/IEC 27001. | Customers or partners ask for a certifiable privacy standard, you operate internationally, or you already run an ISO management system. |
| SOC 2 with the Privacy category | An attestation report under the AICPA Trust Services Criteria. Security is always included. Privacy is an optional category with criteria covering notice, choice and consent, collection, use and retention, access, disclosure, quality, and monitoring. | Your US customers already ask for your SOC 2 report and you want privacy controls tested in the same audit. |
A common pattern: use the NIST Privacy Framework internally to assess maturity and plan, and add ISO/IEC 27701 certification or the SOC 2 privacy category later when customers ask for outside assurance. Whatever you pick, map your obligations register to it, so each control traces back to a legal or contractual requirement.
In the same month, do a gap assessment against your chosen framework and your top obligations. Rank gaps by risk (from the leadership exercise above) and effort. This becomes your 12-month roadmap.
Days 61-90: quick wins
Quick wins build credibility and often remove real risk. Pick three to five that matter for your company:
- A working request intake. A clear route for privacy requests (web form or email address, plus phone if the CCPA requires it for you), a tracker with deadline dates, and a short runbook. See Handling data subject requests.
- Fix the website basics. An accurate privacy notice, a cookie banner that actually blocks tags before consent where required, and Global Privacy Control honored for US visitors. Run the website privacy audit to find the gaps.
- DPAs with your top vendors. List the vendors that process the most personal data and confirm each has a DPA and a sub-processor list. See Data processing agreements.
- A privacy step in vendor onboarding and product design. A short questionnaire that triggers a deeper review only when needed.
- Delete something. An old marketing list, a forgotten database copy, expired logs. Reducing what you hold is the cheapest risk reduction there is.
- Breach readiness. Agree with security and legal on who decides whether an incident is notifiable, and keep the regulator deadlines (72 hours under GDPR Article 33) on one page.
What to measure
Pick a few metrics you can actually collect, and report them to your sponsor on a regular schedule. Good starting metrics:
| Metric | Why it matters |
|---|---|
| Privacy requests received, closed, and closed on time (by type) | Shows the operational load and the legal risk of missed deadlines. |
| Median days to close a request | Tracks whether process changes are working. |
| Share of high-risk systems with an owner and an inventory entry | Measures how much of your data you can account for. |
| Share of in-scope vendors with a DPA and a completed review | Third-party risk coverage. |
| Assessments (DPIAs or risk assessments) completed before launch vs. after | Whether privacy review happens early or as cleanup. |
| Open risks by rating, and age of the oldest high risk | Keeps accepted and unresolved risks visible to leadership. |
| Privacy incidents and near misses | A rising number early on often means better detection, not worse practice. Say so when you report it. |
Avoid vanity metrics like "policies published" or "employees trained" as headline numbers. They measure activity, not risk.
At day 90
By the end of the first quarter you should be able to show: an obligations register, a starter inventory, a named sponsor and risk owners, a chosen framework with a gap assessment, a 12-month roadmap, a few completed quick wins, and a first metrics report. That's enough to ask for the budget and people the roadmap needs, whether that's tooling (see Choosing privacy software without regretting it), outside help (see Hiring a data privacy consultant) or headcount.
This is a planning guide, not legal advice. Which laws apply to you is a legal question, so get counsel to confirm the obligations register.