3.4: Project Management Considerations

Assessing the current state

Based on what the GDPR regulation requires, what an organization needs to do is going to be based on an assessment of what the current state of compliance is and what needs to be done to achieve the desired level of compliance.

The assessment likely would be conducted by a cross-functional team with representatives from, but not limited to, the following organizations:

• Legal staff
• Information technology or product development staff familiar with the relevant applications, data bases, user interfaces, etc.
• Network staff who can address network security issues
• Business analysts familiar with the company's processes and flows
• Corporate risk analysis staff
• Project Management Office/Project manager

Identifying gaps

After completing the assessment, you are now aware of gaps. What gaps? The gaps could be, but are not limited to, any of the following:

• Implementation gaps. Based on your current organizational processes, implementation of key applications, and networking infrastructure, you have itemized things that need to be done to close the gaps to get the organization to what your team perceives to be the desired state of compliance.
• Capability gaps. You have determined that your organization does not currently have the staff on hand in the organization to proceed with certain elements of the implementation. Your organization may not currently have a Data Protection Officer (DPO).

Preparing a strawman plan of action

A Work Breakdown Structure (WBS) can be prepared based on a preliminary scope for the project. A preliminary straw-man schedule can be prepared along with a preliminary project budget and resource plan.

Getting project steering committee approval (Concept)

At this point, a recommendation about scope, budget, resources, and schedule can be presented as part of a concept review with an executive project steering committee. The project steering committee can review this preliminary work and determine what changes are needed to be consistent with corporate goals and strategy and notify the project team to proceed accordingly.

Preparing a formal project plan

The project team can then incorporate these changes and begin work on formal project planning. The project scope and detailed requirements can be documented. A formal project plan can be prepared including a schedule, resource plan, and budget.

This is where it gets real, in the sense that the resources that are applied to the project activities must actually be available to be assigned to project work. Some hiring for in-house resources may need to be identified and hired by the responsible development groups. Some external consulting resources may need to be procured as external contractors.

For all of the required development work, the technical teams can prepare formal specifications.

Getting project steering committee approval (Planning/Specification)

At this point, a formal Phase 1 exit review team is scheduled with the project steering committee to gain official approval to proceed.

The list of potential work was covered in the "Implementing GDPR Compliance" section. The work to be done will vary from company to company based on each company's starting point and corporate strategy and objectives. The sense of urgency in completing the work will also span a broad spectrum. In addition, the risk appetite of the executive team may be such that they will take the risk to not implement certain work.

The project scope could also include whether the company is planning to seek a formal certification and whether outside consultants might be required for that certification effort.

The potential hiring of a Data Protection Officer needs to be addressed. That may or may not be within the scope of the project. It may be an executive action item.

After gaining that approval, the project can proceed to implement the agreed-upon scope, using the approved resources, and go so within the approved budget.

On-going project status monitoring

It is likely that a compliance project such as GDPR compliance is going to attract executive attention. As a result, plans should be made to have on-going project status reviews with the project steering committee and any other stakeholders. The project manager can reference the stakeholder register to determine what other executive check-ins are needed along with their frequency.