Privacy Governance in Practice: From Data Inventory to Accountable Decisions
A privacy policy can explain an organisation’s intentions. Privacy governance determines who makes decisions about personal information, what evidence they use, and what happens when the evidence is incomplete. The practical test is simple: can the organisation explain a real processing activity, identify its owner, show the controls that operate, and defend the decision to proceed?
This article sets out a practical operating model for connecting inventories, privacy impact assessments, vendor oversight and management reporting. The examples are fictional learning scenarios, not consulting results or claims of legal compliance.
Start with the decisions, not the documents
A useful programme answers concrete questions. Should a new service collect this information? Can an existing vendor use it for another purpose? Who approves a longer retention period? What changes when a service moves to a different region? A document becomes valuable when it informs one of those decisions and records who is accountable for the outcome.
Define the decision gates before collecting every possible field. Establish when privacy review is required, who provides operational facts, who advises on risk, who can approve residual risk, and when an unresolved issue must be escalated. The privacy lead should coordinate the process; business owners must remain responsible for how their activities operate.
Build an inventory that reflects operational reality
An inventory should describe processing activities, not just a list of applications. For each activity, record the business purpose, affected people, information categories, source, systems, vendors, recipients, hosting location, transfers, retention rules, owner and review date. Identify where the record is verified and where it is still an assumption. A named owner and an evidence link are more useful than a confident-looking row nobody can validate.
Regional differences matter. In the fictional enterprise-scale inventory on the Resources page, a multinational has about 25,000 employees and 14 million customers across six regions. The workbook contains 97 processing activities and 47 vendors. Payroll, recruitment, contact centre, CCTV, marketing and incident reporting each appear once per region because hosting, law and owners differ. Those entries are deliberate distinctions, not accidental duplicates.
Use a common activity family to connect related regional records, while retaining the differences that affect decisions. The Summary tab adds counts by region and a High-risk-vendor check. These are starting points for review: counts show coverage, while the vendor check helps identify where additional evidence or assessment may be needed. Neither demonstrates that the underlying controls are effective.
Turn the inventory into a review queue
A complete-looking inventory can still hide serious uncertainty. Prioritise activities by the consequences for people, sensitivity and scale of information, new uses, monitoring, external access, retention, international handling and the reliability of existing controls. Record the reasoning behind the priority instead of relying on a colour alone.
Create separate actions for missing facts and identified risks. “Confirm hosting location” is an evidence task. “Restrict vendor access before launch” is a control action. Each needs an owner, due date and escalation route. This distinction prevents an assessment backlog from becoming a collection of documents with no operational follow-through.
Use impact assessments to change the design
A privacy impact assessment should make the proposed activity understandable before judging its risks. Map the information flow from collection through use, sharing, storage and deletion. Explain what people expect, what the organisation needs, which alternatives were considered, and why the proposed approach is proportionate to its purpose. Assess harm to people alongside organisational exposure.
For every material risk, specify the change that reduces it, the person who will implement that change and the evidence required to close it. A statement such as “access is controlled” is too broad. A stronger action identifies the roles, approval process, review frequency, logging and test that will demonstrate the restriction works. Document remaining risk after controls and the authority that accepts it.
The worked privacy impact assessment on the Resources page covers about 14 million customers. Its scale is a reason to scrutinise assumptions, failure modes and assurance evidence carefully. The number of customers alone cannot tell you whether a particular processing activity is appropriate. The assessment must still explain purpose, context, affected people and controls.
Connect vendor oversight to the actual data flow
A vendor questionnaire is one input, not the end of oversight. Link each relevant vendor to the activities it supports, information it handles, access it receives and locations involved. Review contractual commitments alongside operational evidence, including access arrangements, incident escalation, deletion, subcontracting and changes to the service.
Decide how unresolved vendor issues affect the service: proceed with conditions, restrict the use, seek additional evidence, choose an alternative or escalate for a documented decision. Give conditions a review date. Track whether they were implemented before treating the item as closed. When a vendor changes its hosting or product features, revisit the linked activities rather than starting a disconnected review.
Bring AI into the same governance system
AI can sit inside an existing vendor product, so an application inventory alone may miss it. Ask business owners what features are enabled and how outputs influence decisions. Record the use case, deployment context, affected people, data inputs, vendor dependencies, human oversight and assessment status. Connect the AI system to the relevant privacy activities rather than maintaining registers that never meet.
The fictional AI register contains 59 systems across 17 business units: vendor-embedded AI, regional chatbots, divisional productivity copilots and three unsanctioned tools. Of 14 High-tier systems, 12 lack a completed impact assessment. That is a visible governance gap requiring triage and decisions, not evidence that every system has caused harm. “High-tier” is the sample’s classification; it should not be assumed to equal a legal category.
The separate recruitment AI impact assessment covers about 420,000 applications a year and 300 recruiters across six regions. Review questions extend beyond privacy to how outputs influence selection, whether people can challenge decisions, how oversight works and what evidence supports performance across deployment contexts. Privacy and AI assessments should share facts while retaining the risks each is intended to examine.
Make accountability visible in management reporting
Report decisions and unresolved exposure, not just document volume. Useful measures include activities without confirmed owners, overdue reviews, priority assessments awaiting completion, conditions overdue for implementation, high-priority vendor issues and exceptions approaching expiry. Distinguish “assessment drafted”, “decision approved” and “controls verified”; combining them into “complete” conceals unfinished work.
Give each measure a denominator and a clear definition. Twelve missing assessments out of fourteen High-tier systems tells a different story from twelve out of fifty-nine total systems. Management should see the affected services, the owner, the interim restrictions and the decision required. Trends are useful only if scope and counting rules remain consistent.
A practical first 90 days
Days 1–30: agree scope and decision rights; identify the business owners; inventory a representative set of activities; validate the most consequential information flows and vendor dependencies. Record unknowns explicitly and establish a review queue.
Days 31–60: assess priority activities, agree design changes and interim controls, connect vendor findings to processing records, and establish a decision log. Test the handoffs between procurement, technology, privacy and business teams with a real upcoming change.
Days 61–90: verify completed actions, escalate overdue conditions, report the remaining gaps and assign the next review cycle. Update the inventory when services change. The aim is a repeatable process in which evidence leads to a decision and the decision leads to an observable action.
Use the worked examples as a connected set
Start with the personal information inventory to understand activities and dependencies. Use the privacy impact assessment to examine a priority activity. Use the AI register to identify AI-enabled use cases and assessment gaps, then the AI impact assessment to document the context and decisions for a deployment. Adapt the fields, risk criteria and approvals to your organisation rather than treating sample scores as universal rules.
Privacy governance becomes credible when someone can trace a processing activity to its owner, assessment, controls, decision and next review. The strongest next step is usually to validate one important activity end to end—and use what you learn to improve the wider programme.
Comments