A compliance platform built around one regulation
The situation
A data protection law is coming into force. It reaches firms that have never tracked how they handle personal data.
Each one needs to know what applies to it, where it falls short and what to do first.
The platform is being built now and is not finished. What follows is the problem and how the platform is designed to work.
Why it is hard
Whether an obligation applies depends on facts a firm often does not know yet.
Are any users children? Where do vendors store data, and how many users are there?
- Most checklists treat an unknown as a no. A firm then looks compliant because it did not answer.
- “Met” means nothing without evidence. A firm can tick a box for work it has not done.
- A readiness percentage can reward leaving questions blank. The worked example below shows how.
- The rules are legal text. A platform that gets one condition wrong gives confident, wrong advice to every firm on it.
The approach
A firm describes itself in four ways. It answers a short self-check and gives the company’s details.
It also records every purpose it uses personal data for, and every vendor it shares data with.
Each obligation is stored as a rule with a condition, not as a line in a checklist.
- Every condition has three outcomes: applies, does not apply, or cannot tell yet.
- A blank or “not sure” answer gives “cannot tell yet”, never “no”.
- Conditions combine. “Any” is true once one part is true. “All” is false once one part is false. Otherwise the answer waits.
- Each outcome carries its reasons: the answers, purposes and vendors that decided it.
For each obligation that applies, the firm records a status. Met needs a written method and evidence, and the database refuses it otherwise.
Gaps become tasks with an owner and a due date. The items that take longest to fix are due first.
Every “not sure” answer becomes something to find out.
Lawyers check each rule and write the legal text. Nothing a client sees goes out without their approval.
That review has not happened yet. Until it has, and until a security review is done, the platform runs on invented data only.
A worked example
This is the rule logic on a synthetic firm, not a result. The firm is checked against 24 obligations, grouped by the condition that decides them.
| Group | Obligations | Applies when | Outcome for this firm |
|---|---|---|---|
| Every firm | 10 | always | Applies |
| Consent | 5 | a purpose relies on consent | Applies |
| Children | 2 | users under age, or a purpose for them | Cannot tell yet |
| Data abroad | 1 | a vendor stores data in another country | Applies |
| Vendors | 2 | a vendor handles data for the firm | Applies |
| Top tier | 1 | the firm is designated | Does not apply |
| Marketing | 1 | promotional messages and a marketing purpose | Does not apply |
| Sector threshold | 2 | more than 50,000 users | Cannot tell yet |
Of the 24, 18 apply and two do not. The other four cannot be judged yet, because the firm was not sure about two facts.
It does not know whether any users are children. It gave its user count as a range, from 30,000 to 80,000, across a threshold of 50,000.
Of the 18 that apply, seven are met with evidence and five are partly met. Another four are not met, and two have no status yet.
Readiness is the share that is met: 38 percent. Partly met counts for nothing.
Now suppose the firm answers the children question with a yes. Two more obligations apply, neither is met, and readiness falls to 35 percent.
The honest answer lowers the score. That is why the platform shows the obligations it cannot judge beside the percentage, never behind it.
Where it breaks
- Evidence is checked for being there, not for what it says. A link to the wrong document still counts.
- The readiness figure leaves out what cannot be judged yet. Fewer answers can mean a higher figure.
- Some tests are blunt. Any vendor storing data abroad counts as data leaving the country, and user numbers are bands.
- The rules are only as good as the lawyer review, which is still to come.
If a new regulation applies to you, find out what you do not know before counting what you have done.