Close the Privacy Action Gap in 90 Days

Your board approved the privacy budget. Your team attended the training. Everyone agrees customer data matters. So why are access logs still unmonitored and retention schedules still sitting in draft?

Canadian businesses face a troubling pattern: widespread acknowledgment that privacy matters, paired with failure to implement fundamental protections. This isn't a knowledge problem. It's an execution problem, and it creates regulatory exposure under the Personal Information Protection and Electronic Documents Act.

This playbook gives data governance teams a 90-day path from awareness to operational privacy controls.

The Problem: Bridging the Gap

The gap between intent and implementation shows up in three places:

Unmanaged access: Teams know who provisioned access to customer records. They don't know who accessed what data last week, or whether former employees still hold credentials.

Missing retention enforcement: Retention policies exist in policy documents. Deletion happens manually, inconsistently, or not at all.

Consent without verification: Marketing teams collect consent. No one audits whether that consent covers current processing activities or whether withdrawal requests actually stop data use.

Each gap represents a compliance failure and a breach risk. When a Supervisory Authority asks for access logs during an investigation, "we know it's important but haven't implemented controls" won't reduce your penalty.

What You Need Before Starting

Before Day 1, secure these resources:

Stakeholder commitment: Written approval from your Chief Privacy Officer and IT leadership for three months of dedicated implementation time. Privacy controls require cross-functional coordination. You need authority to request changes from engineering, marketing, and operations.

Technical access: Administrative credentials for your identity management system, data storage platforms, and any consent management tools. You can't implement controls you can't configure.

Current state documentation: A list of systems processing personal data, existing retention policies (even if unenforced), and current consent collection points. You're fixing gaps, not building from zero.

Implementation team: Assign one technical lead, one privacy analyst, and rotating subject matter experts from affected departments. The technical lead configures controls. The analyst validates compliance. Department experts ensure you don't break operational workflows.

Step-by-Step Implementation

Days 1-30: Access Control and Logging

Week 1: Audit current access

Run a credential audit across all systems processing personal data. Export user lists from your identity provider and compare against your current employee roster.

For each system, document:

• Who holds administrative access
• Whether access reviews occur (and when)
• Whether access logs exist and where they're stored

Revoke credentials for any departed employees immediately. This addresses the most critical exposure.

Week 2-3: Implement access logging

Enable detailed access logging on systems handling customer data. At minimum, capture:

• User identity
• Timestamp
• Data accessed (record ID or data category)
• Action taken (view, modify, delete, export)

Configure logs to write to a centralized location your security team monitors. If you use AWS, enable CloudTrail for S3 buckets containing personal data. For database access, enable audit logging in PostgreSQL or MySQL and forward logs to your SIEM.

Week 4: Establish access review schedule

Create a quarterly access review process:

1. System owners receive a list of current users with access to their systems
2. Owners confirm each user still requires access
3. Unnecessary access gets revoked within five business days
4. Privacy team receives confirmation of review completion

Document this process and add calendar reminders for the next review.

Days 31-60: Retention Enforcement

Week 5: Map retention requirements

List every category of personal data you process and its required retention period. Your existing Retention Rule provides the rules. You're building the implementation.

For each category, document:

• Where the data lives (which systems, databases, or file stores)
• Current retention period
• Technical deletion method available

Week 6-7: Automate deletion where possible

Implement automated deletion for high-volume, low-risk data first:

For database records, create scheduled jobs that purge data past retention. Example PostgreSQL script:

DELETE FROM customer_interactions 
WHERE interaction_date < CURRENT_DATE - INTERVAL '2 years';

For object storage, use lifecycle policies. In AWS S3, configure a lifecycle rule that expires objects with specific tags after your retention period.

For data requiring secure deletion (financial records, health information), verify your deletion method meets regulatory standards. Standard deletion may not suffice.

Week 8: Manual deletion process for complex data

Some data requires manual review before deletion (data subject to preservation orders, data tied to ongoing investigations). Create a monthly review process:

1. System generates a report of data approaching retention deadline
2. Legal/compliance reviews the list for holds
3. Approved deletions proceed
4. Privacy team receives deletion confirmation

Days 61-90: Consent Verification and Maintenance

Week 9: Consent audit

Review every point where you collect consent. For each:

• Confirm the consent language covers current processing activities
• Verify you're storing consent records with timestamp and specific consent text
• Check whether you have a mechanism to honor withdrawal

Common gaps: consent collected for "marketing" but used for analytics, no record of what the consent form said at collection time, withdrawal requests handled manually without verification.

Week 10: Implement consent verification

Before using data for any purpose requiring consent, verify current consent status. This requires:

1. A consent record store linking data subjects to consent status
2. Application logic that checks consent before processing
3. A process to propagate consent withdrawals to all systems

If you use a Preference Center, integrate it with your operational systems. Consent changes should propagate automatically, not require manual updates.

Week 11-12: Withdrawal workflow

Build a documented workflow for consent withdrawal:

1. Customer submits withdrawal request
2. Request logged in tracking system within 24 hours
3. Consent record updated in central store
4. Automated sync updates operational systems
5. Confirmation sent to customer within five business days
6. Privacy team receives monthly report of withdrawal requests and completion status

Test this workflow with a dry run before going live.

Validation: How to Verify It Works

Run these checks at Day 90:

Access control validation: Pull access logs for three systems. Verify logs capture required fields. Attempt to access data with a test account that shouldn't have access. Confirm access is denied and the attempt is logged.

Retention validation: Query your databases for records that should have been deleted. If you find data past retention, investigate why automated deletion failed. Check your manual deletion queue for pending items older than 30 days.

Consent validation: Submit a test withdrawal request. Track how long it takes to propagate to operational systems. Verify processing stops for that test subject.

Document validation results. When your Supervisory Authority asks what controls you have in place, you'll show them evidence, not policy documents.

Maintenance: Ongoing Tasks

Privacy controls degrade without maintenance. Schedule these recurring tasks:

Monthly:

• Review access logs for anomalies
• Process manual deletion queue
• Review consent withdrawal completion rate

Quarterly:

• Access review for all systems
• Test consent withdrawal workflow end-to-end
• Review retention automation for failures

Annually:

• Audit consent language against current processing activities
• Review and update retention periods based on legal changes
• Validate secure deletion methods still meet regulatory standards

Assign ownership for each task. When maintenance tasks have no owner, they don't happen.

The gap between privacy awareness and privacy implementation closes when you treat controls as engineering work, not policy work. You wouldn't deploy code without testing it. Don't deploy privacy controls without validation. At Day 90, you'll have access controls, retention enforcement, and consent verification you can prove work. That's what turns intent into protection.