How you and others can digest your GDPR project

Originally published on LinkedIn in January 2017, as the third in a series on running a GDPR project. The previous posts covered GDPR project considerations and the Visual Privacy Program Game Plan.

“When eating an elephant take one bite at a time.”

This quote, attributed to US Army General Creighton W. Abrams, is highly relevant to a GDPR project.* Breaking down your GDPR project into key deliverables will help you plan the work, understand dependencies, allocate resources, and communicate to senior stakeholders the focus and scale of the project.

POTI analysis #

In order to define project scope and identify specific project deliverables, a holistic view is needed — but seen from various perspectives. Borrowing a technique from MSP (Managing Successful Programmes) known as POTI analysis, you can identify GDPR impacts across the following dimensions and apply these to your organisation.

POTI diagram showing GDPR Impacts with arrows pointing to Processes, Organisation (competences, mindset and accountability), Technology, and Information (Policies, contracts etc)

P — Processes: procedures and functions
O — Organisation: roles and responsibilities, staffing levels, skills and culture
T — Technology: tools, IT, applications, infrastructure
I — Information: data, documents

Before you do this, you might want to consider your level of compliance with existing data protection legislation, as discussed in an earlier article. If you are already able to demonstrate compliance with, say, the 1995 Data Protection Directive, then you can focus on the impacts of the key changes the GDPR brings. If not, deeper analysis will be required.

Applying POTI in practice #

In addition to POTI analysis, consider taking a Product Based Planning approach as advocated by PRINCE2 to pinpoint specific deliverables. Taking the requirement for Data Breach Notification as an example: the GDPR contains a definition of “personal data breach” and notification requirements to both the supervisory authority and affected data subjects. This requirement has multiple impacts (very high level examples shown):

Process: Update existing process (if it exists) or define a new one; consider interfaces to other processes; process implementation (decommission existing if not fit for purpose), etc.

Organisation: Process owner required; internal or external recruitment? Existing role? Define responsibilities; role-based training; communication of new process, etc.

Technology: What system may be needed to support the breach notification process? Use existing or source new?

Information: Reporting (external and internal, formats); records format; statistics, etc.

Building a Product Breakdown Structure #

POTI analysis involves collaborating with key stakeholders across the organisation to get the initial list of impacts — typically via workshops and interviews. From there, specific deliverables (or products) can be identified and then a Product Breakdown Structure (PBS) produced. The PBS is a great visual tool for documenting, analysing, and presenting the specifics of your GDPR project.

Example GDPR Product Breakdown Structure showing deliverables organised across Process, Organisation, Technology, Information, OCM and Project Management columns

The deliverables in your PBS can then be scheduled to form a GDPR Deliverables Roadmap — a visual representation of what your project will be delivering over time. The example below also includes core project tasks and maps to the four key areas from the Visual Privacy Program Game Plan: Gap and Risk Assessment, DP Governance Framework, Organisational Change Management, and Control and Policy Implementation.

Example GDPR Deliverables Roadmap showing project tasks and deliverables scheduled across 2017 Q1 through 2018 Q1

Deliverable Descriptions #

Each deliverable is also described in the form of a Deliverable Description, which references the specific parts of the GDPR that make it a requirement. This is always useful when a senior stakeholder claims “we don’t need this and that”. Key tasks and resources needed to produce the deliverable are specified and can then be copied across to your detailed project schedule.

Example Deliverable Description for a data flow mapping procedure, showing purpose, GDPR reference, and description and format sections

Frequently Asked Questions #

What is POTI analysis in a GDPR context? POTI analysis is a technique borrowed from MSP (Managing Successful Programmes) that helps identify the impact of GDPR requirements across four dimensions: Processes, Organisation, Technology, and Information. It is used to define project scope and identify specific deliverables.

What is a Product Breakdown Structure in a GDPR project? A PBS is a visual tool that organises all of the deliverables your GDPR project needs to produce, structured across categories such as Process, Organisation, Technology, and Information. It makes it easier to plan work, allocate resources, and explain scope to stakeholders.

What is a GDPR Deliverables Roadmap? A GDPR Deliverables Roadmap is a scheduled view of your PBS — showing what will be delivered and when, from project kick-off through to compliance. It is a practical tool for tracking progress and communicating the plan to senior stakeholders.

I publish a fortnightly newsletter on data protection and privacy — practical, opinionated, and free. You can sign up on the newsletter page.