Finding
Regulatory debt
Things stall at review because privacy was left until after the build.
The pattern is always the same: something is built, then shown to legal, then rebuilt. Nobody involved did anything wrong. The audit trail, the access model and the data minimisation were simply not part of the specification, and they cannot be added at the end without touching everything.
It reads as legal being slow. It is not. A reviewer who cannot see who touched what, when, and under which authority has no way to say yes, and saying no is the only responsible answer available to them.
This is the one condition where reading about the fix and having the fix are furthest apart, because the fix is an architecture rather than a checklist.
Measured in months of a feature waiting, not in fines.
How it shows up
- A launch date slips because review has questions nobody prepared for.
- Customer data gets pasted into a chat window to get a quick answer.
- Nobody can say which country a given vendor keeps the data in.
- The processing agreement was signed and never read.
- There is no single list of who can see what.
How to put a number on it
List every place customer data leaves your own systems — every vendor, every integration, every model behind an API. For each, write the jurisdiction, whether a processing agreement exists, how long the data is kept, and how a deletion request is actually executed. The rows you cannot complete are the exposure.
Then look at the last two launches and count the weeks they spent waiting at review. That number is what this costs today, and it is paid whether or not anybody is ever fined.
What to do this week
Take the four vendors that touch personal data and write one line each: jurisdiction, agreement, retention, deletion route. Four lines is an afternoon, and it is the document review asks for first.
Then decide, in writing, what may never be pasted into a chat window. The rule is worth more than the tooling, because the leak that happens is almost never the one somebody designed a system around.
The next step
A call, always. The answer depends on which regime you are under and what the reviewer has already refused, and neither of those is in an article.
Find out what this is called →