budding
planted 2026-02-25 · tended 2026-03-11
unverified — check
Placeholder note
Structure is real; the content is not written yet. [draft — Peter to write]
A privacy program is less a document than an operating rhythm. This note is the order I’d build one in if I were handed a company with none.
First, find the data
You cannot protect what you cannot see. Data mapping comes before policy, always. [draft — Peter to write] — the inventory, the systems interviews, the retention reality-check.
see also
The litigation notes are the failure modes this program is meant to prevent — start with the BIPA map.
Only once the map exists do notice, choice, and vendor terms have anything to attach to.
Then, the paper that has to be true
[draft — Peter to write] — the policy stack, the DPIA trigger, and the vendor-diligence loop.