Practical Data Protection in Organizations is about Privacy in practice og GDPR for normal operation. Meaning that privacy becomes part of everyday life, not a project that pops up when someone asks, or when something goes wrong.
In short. GDPR often becomes a side project because «doing nothing» rarely has immediate consequences. As a result, many companies end up with nothing, quick fixes, or Excel sheets. Lasting control is achieved when privacy is built into the routines you already need to run your business. Clear ownership, up-to-date overviews, and documentation that follows the workflow. That's Privacy in practice.
Tips. This technical article is intended as an anchor in the series on GDPR as standard operation. I will link back here from several short posts about ownership, routines, tools, and practical examples.
Content
- Why GDPR is losing in practice
- “Biff-chef” in privacy. Integrated routines
- Three patterns that make privacy an afterthought
- Short case. “It wasn’t until the customer asked…”
- What actually works over time
- Many small becomes big
- Fact box. Small steps that have a big impact.
- Checklist. Signs that privacy is becoming standard practice
- Related reading
Why GDPR is losing in practice
In many businesses, privacy is important, but rarely urgent. When a task isn't perceived as urgent, tasks that are more pressing usually win out. Deliveries, sales, operations, recruitment, IT projects, and «what's burning now.».
I call this the consequence gap. The risk is real, but the consequence feels distant. The result is that GDPR easily becomes a side project, until something triggers the need. This is why GDPR as standard operation og Privacy in practice must be built into the way we actually work.
Typical triggers that suddenly make privacy important
- Revision or review questions
- Customer requirements in sales or procurement
- Requests for information that take time and cause unrest
- Deviations or incidents
- Growth, reorganization, acquisitions, or new systems and suppliers
When privacy is only prioritized after it's triggered, we often see one of two reactions. Either it's postponed again, or an attempt is made to solve it quickly. Both can provide a sense of control, without the control being lasting.
“Biff-chef” in privacy. Integrated routines
When a chef cooks a steak, they season it too. Seasoning isn't a separate project alongside cooking. It's an integral part of the routine to achieve a good result.
Privacy works the same way. It doesn't become robust until you build it into your everyday routines. That's how you get Privacy in practice og GDPR as standard operation.
1) Procurement and supplier selection
When considering price, quality, and delivery capability, the routine should also include a simple privacy check
- Shall the supplier process personal data
- What types of data, and what scope
- What risks and consequences can this entail
- Do we need a data processing agreement, and how do we follow up in practice?
Then privacy becomes an integral part of the procurement process, not a documentation exercise that comes afterwards.
2) Changes in systems and processes
When you make changes, new features, new systems, or new workflows, the routine should also include a simple check
- Does this change how personal data is collected, used, shared, or stored?
- Must we update internal records, routines, or external information, such as the privacy policy?
Then privacy becomes part of change management, not something to be remembered «at the end.».
3) Onboarding, offboarding, and access management
When an employee starts or leaves, you already have routines in place for equipment, access, and training. Privacy should be an integrated part of this process.
- Access only what is necessary
- Role-based privacy expectations as part of training
- Terminate access and ensure correct handling upon termination
The point is: responsibility, documentation, and control work best when they are integrated into a routine, not as an extra GDPR project on the side.
Three patterns that make privacy an afterthought
Through practical work with businesses, the same patterns emerge again and again. They are understandable, but they scale poorly over time.
Nothing
Privacy is «on the agenda,» but it keeps getting pushed back. It feels overwhelming to start, and there's always something more urgent.
Typical consequence. The company lacks an overview when a claim or incident suddenly arises, and must work under time pressure.
Quick fixes
People are trying to solve it quickly, for example, by
- Copy a privacy policy from someone who «resembles»
- Signing data processing agreements without actual review of data processing and risks
- Thinking that «we don't need RoPA,» or postponing the overview because it seems daunting
- Delegate everything to «X» (CFO, HR, IT, or a key person) and hope for the best
Typical consequence. It looks better on paper than in practice. Privacy is not integrated into the work where personal data is actually processed.
3) Excel
Excel may seem cheap and straightforward, but it often leads to duplicate work. First, you have to design and maintain the «system» (structure, versions, updates). Then, you have to do the actual GDPR work in addition, and ensure that everyone is using the correct version.
Typical consequence. The control becomes fragile. Maintenance becomes a separate task, and oversight quickly becomes outdated when everyday life takes over.
Short case. “It wasn’t until the customer asked…”
Consider the following scenario. A company believes they are “on top of” GDPR. They have a privacy policy and a folder with some documents. Then a customer requirement comes in during a procurement process: “Describe the processing, vendors, and security measures. Attach data processing agreements.”
It turns out that
- No one has compiled an overview of which vendors actually process personal data.
- Data processing agreements are scattered, partially outdated, and some are missing.
- Several processes have been changed without updating the privacy policy
They had “done GDPR,” but it wasn't built into their procurement and change management routines. It therefore became reactive. The result was stress, improvisation, and a feeling that GDPR was getting in the way, instead of providing support, control, and predictability. This is exactly what GDPR as standard operation will solve.
What actually works over time
1) Start the alt starter. Get an overview
Nothing happens until you start. And little works if you don't have an overview.
A practical starting point is to map out
- Which systems process personal data
- What are they used for, what processes do they support
- Who operates and supports them, internally and externally
- What types of personal data are included, and where do they flow?
The goal is not perfection, but an overview that is good enough to manage, prioritize, and improve. It is Privacy in practice.
2) Management owns direction and priority
Management's job is rarely to “do GDPR.”. Leadership's job is to own direction and priority. Set expectations, clarify responsibilities, and ensure follow-up when privacy conflicts with urgent tasks.
In practice, it often means
- To decide what the “least reasonable level” of control for the business is
- Ensuring privacy is built into important routines
- Follow up to ensure routines are actually used and maintained
- Prioritizing privacy when implementing new systems, suppliers, or processes
Privacy cannot be owned by one person alone
Many ask. “Can't X just take this?” It can seem rational, but privacy errors rarely happen where responsibility is formally assigned. They happen where the work is done. In HR, customer service, sales and marketing, finance, operations, product, and IT, and in vendor dialogue.
This doesn't mean everyone has to become a privacy professional. It means that everyone who handles personal data must understand the basics and know what is expected regarding privacy in their role. It is GDPR as standard operation.
4) Make routines role-based and realistic
Routines must be so simple that they are actually used. A good routine is not one that looks best on paper, but one that survives a busy Tuesday.
Examples of routines that should often be in place
- Onboarding and offboarding. Access management, equipment, email, shared drives, termination of access
- Access requests. Who does what, within what deadlines, and how are responses and assessments documented
- Supplier Management. Who approves, what is checked, where is it documented, and when is the supplier reassessed?
- Deviations and incidents. Low threshold for reporting, clear evaluation process, learning and improvement
- Changes. Privacy assessment as part of the change process before new solutions are rolled out
Documentation as part of the routine, not a document project
Documentation is often treated as an afterthought requirement. It rarely works. What works is when documentation is updated in the same flow as the work and is accessible to those who need it.
A practical example is documents and agreements
- Let the contract text describe roles, responsibilities, delivery, and conditions, as much as possible without personal data
- Place personal data in a standardized attachment (e.g., contact and role overview) that can be updated and replaced.
The effect is often significant. The main document can live for a long time without unnecessarily carrying personal data. The attachment can be updated when people leave or change roles. It becomes easier to keep order, and easier to comply with storage and deletion requirements.
Tools to help you keep it up to date
Tools don't solve weak privacy work. But a well-designed tool can help in two ways. It makes it easier to get started, and it makes it easier to keep controls up-to-date as everyday life takes over.
A simple sign that you are approaching the tooling point. You spend more time maintaining the overview than improving practice.
Many small becomes big
If you want to make progress without turning privacy into a major project, you can start with five questions. They often have more impact than starting with large document deliveries.
- What triggered this now
- Where are personal data processed the most, top 3 processes and areas
- How do you keep track of updates today, and who does it?
- Which routines are most relevant to “spice up” first?
- What's the smallest next step that has an impact?
Fact box. Small steps that have a big impact.
Small reorganizations can reduce unnecessary personal data, make it easier to keep data up-to-date, and at the same time make the rest of the information more accessible, without GDPR noise.
- Contracts and agreements. Move personal data to the appendix. Keep the main agreement as free of personal data as possible.
- Meeting Minutes. Hold the decision as the main document. Place person-specific details in an appendix.
- Reporting. Aggregated statistics from personally identifiable data
- Customer service. Avoid duplicating personal data in free text. Retrieve data from the system as needed.
- Email. Let email be transport, not archive
- Excel. Separate identity from content, and move when it scales.
- Deleted areas. Use templates that minimize free text, and dedicated areas with stricter access and deletion routines
- Supplier Management. Make privacy a standard item in your routine, on par with price and quality.
Checklist. Signs that privacy is becoming standard practice
- We know which 5 to 10 processes account for the most personal data processing.
- Privacy is built into procurement, changes, and onboarding and offboarding.
- Responsibility is clear in the line where data is processed, not just with a coordinator.
- Transparency can be handled predictably without panic and detective work.
- Suppliers are evaluated according to a fixed and realistic routine
- Documentation is updated in the same flow as the work changes
- There is basic role-based understanding in relevant teams
Conclusion
Privacy works best when it is understandable and relevant across roles, has clear ownership in the line, and is built into routines that are actually used. With documentation that follows the workflow.
To summarize in one sentence: Leadership must own the direction, but privacy must be integrated into the routines where the work happens, much like seasoning a steak; it's best done while the chef is cooking it.
Related reading
The data processing agreement is the gateway to mutual understanding of data privacy.
If you want vendor management to work in practice, this is a good place to start.
The Sportadmin case. Data processor can be sanctioned directly
A concrete example of why “security and privacy by design” are not just buzzwords.
MFA is good. Phishing-resistant login is better.
If you want to understand what actually withstands phishing, without getting technical.
GDPR and Privacy. A Critical Guide for Forward-Thinking Leaders
When you want to explain GDPR from a management perspective, not as a document exercise.
