1. What you will learn
This lesson helps you set three measurable privacy outcomes for the next ninety days and run a quick diagnostic of where your data handling is strong or weak. You will finish with a scorecard, a ranked list of gaps and three outcomes with owners and dates.
2. The idea explained
Data privacy work can feel endless, because there is always another file, another tool or another rule to look at. An outcome map cuts through this by asking what you want to be true in ninety days. Good outcomes are observable. Examples are: every place holding personal data has a named owner and a purpose; every person who no longer needs access has lost it; every form that collects data states plainly why; a written response plan exists for a lost phone or a wrong email. Weak outcomes are vague, such as be compliant or improve security. Compliance is a legal conclusion that a lawyer must reach, and security is a broad idea that needs to be broken into steps.
The diagnostic that comes first asks about seven habits. Do you know what personal data you hold and where? Do you know why you hold each set? Do you tell people what you do with their data when you collect it? Do you control who can access it? Do you protect it with basic measures such as passwords, locks and updates? Do you know how long you keep it and delete or archive when the time comes? Do you have a plan for incidents and requests from people about their data? Score each from zero to three, where zero is never, one is sometimes, two is usually, and three is always and recorded. The total out of twenty-one is a conversation starter, not a certificate.
Evidence keeps the scores honest. Beside each score, write the file, date or example that supports it. If you cannot point to something, lower the score by one. A score is more useful when it points to a specific file than when it reflects a feeling. It also helps to have someone else challenge two of your scores, since owners tend to be generous about habits they intend to build.
Finally, set the size of your outcomes to the size of your business. A one-person consultancy does not need a formal committee. A twenty-person shop needs to clarify who does what. In both cases, the aim is a few habits that survive a busy month. Remember that the diagnostic does not tell you whether you satisfy the law. For that, a lawyer must look at the actual rules and your facts.
Apply it
3. How to apply it in your own business
Write the seven habits down the side of a page. Score each from zero to three with evidence. Add the total and write it with today's date at the top. If you have staff, ask two of them to score independently and compare; differences point to habits that exist for the owner but not for the team.
Choose the three lowest scores and turn them into outcomes. Use the form: by a date, this measure will move from this baseline to this target, and this person will check it. For example: by the end of month three, the share of data sets with a named owner and stated purpose will rise from 40 per cent to 100 per cent, and the owner is me.
Test each outcome against your time and information. If it needs a decision from a lawyer, add that step and a date. Finally, put review dates for day thirty, sixty and ninety in your calendar, and share the page with someone who will ask you about it. Keep the diagnostic, because you will repeat it at day ninety and compare the two.
Worked example
4. Worked example
Take Sudha, who runs a small chain of two beauty salons with eight staff. She scores her seven habits. Knowing what data she holds: 1, since she knows of the appointment app and the client cards but not the staff phones. Knowing why: 2. Telling people: 0, because no notice exists. Controlling access: 1. Basic protection: 2. Retention: 0. Incident and request plan: 0. The total is 1 plus 2 plus 0 plus 1 plus 2 plus 0 plus 0, which is 6 out of 21.
Her three lowest scores are telling people, retention and incident planning, all at zero. She sets outcomes. First, by day sixty, a short plain notice in the booking form and at reception, drafted by her and reviewed by her lawyer. Second, by day ninety, a retention table for client cards, app records and staff records, with periods confirmed by her adviser. Third, by day thirty, a one-page incident plan: who to call, what to preserve, what to write down.
Her baseline: she holds about 900 client records in the app and 350 paper cards. Together, that is 900 plus 350, or 1,250 records, though some clients appear in both. She estimates 300 duplicates, so about 950 unique clients. Her measure for outcome two is the share of record types with a confirmed retention period, now 0 of 3 types, target 3 of 3.
She tests feasibility. The lawyer meeting takes about an hour and costs money she has to plan for. She asks for a fixed estimate for reviewing a notice and a retention table. She writes down that the outcomes do not guarantee legal compliance and that she will ask the lawyer to say what else is missing. She asks her assistant manager to review her scores independently, and the assistant scores access control at 0 because she has seen former staff still in the group, which lowers Sudha's score from 1 to 0. She thanks her, adjusts the total to 5 out of 21, and starts with access, which is free.
5. Common mistakes and how to fix them
The first mistake is choosing vague outcomes such as be compliant. State measurable results with a baseline and a date, and leave legal conclusions to a lawyer.
The second mistake is scoring without evidence. Attach a file or date to each score, and lower it if you cannot.
The third mistake is scoring alone. Ask two staff to score independently and compare.
The fourth mistake is setting too many outcomes. Keep to three, finish them, and then choose the next.
Key takeaways
6. Board summary
Score seven data habits from zero to three, with evidence. Turn the three lowest into measurable outcomes with owners and dates. Let staff score independently to expose blind spots. Leave legal conclusions to a lawyer. Repeat the diagnostic after ninety days.
Check your understanding
7. Practice and self-check
- What makes an outcome good? Answer: it is observable, measurable and has an owner and date.
- Why is be compliant a weak outcome? Answer: compliance is a legal conclusion, not a measurable habit.
- How many habits are scored and out of what total? Answer: seven habits, out of 21.
- Sudha's scores are 1, 2, 0, 1, 2, 0 and 0. What is the total? Answer: 6 out of 21.
- What is her adjusted total after access control drops to 0? Answer: 5 out of 21.
- How many records does she hold before duplicates? Answer: 900 plus 350, which is 1,250.
- How many unique clients if 300 are duplicates? Answer: about 950.
- Why ask staff to score too? Answer: differences reveal habits that exist only for the owner.
- What is her free first step? Answer: fix access, removing former staff.
- Does the diagnostic show legal compliance? Answer: no, only a lawyer can assess that.