◇ OpenCyber Academy
Postgraduate · Chapter 11 · English

Chapter 11 — Applied project

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Applied project

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Choosing the project"]
  N2["11.2 Delivery"]
  N3["11.3 Effect"]
  N4["11.4 Stakeholders"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Choosing the project"]
  N2["11.2 Delivery"]
  N3["11.3 Effect"]
  N4["11.4 Stakeholders"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 Choosing the project]
    |
    v
[11.2 Delivery]
    |
    v
[11.3 Effect]
    |
    v
[11.4 Stakeholders]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) deliver a privacy improvement project; (2) measure its effect; (3) manage stakeholders through change.

11.1 Choosing the project

Priscila's applied project addresses the worst red indicator: records past retention at 11.0%. She proposes automated retention enforcement across Corvina's main systems, with exceptions for AML records and legal holds. The project aims to bring the indicator below 5.0% within six months. She defines scope, stakeholders and measures, and secures sponsorship from the chief technology officer. She chooses retention because it is the reddest indicator, affects every system and has a clear measure that the board already tracks. A project with a visible number makes progress easy to report and hard to dispute.

11.2 Delivery

The project builds a retention table linking data categories to periods and legal bases, tags records with categories, and runs weekly deletion jobs with review for exceptions. Legal counsel confirms AML periods. The project team tests on synthetic data first, then on one system, then on all. During rollout, a job nearly deletes records under a legal hold because a tag was missing; the review step catches it. The team adds a check that blocks deletion of untagged records. Tagging finishes first.

11.3 Effect

After six months, records past retention fall from 11.0% to 3.8%, below the appetite threshold. Storage costs fall. Rights requests become faster because there are fewer old records to search. Priscila reports the result to the board with the near miss and its fix. She notes that the improvement must be sustained by monitoring and that new systems must join the retention process before launch. The indicator falls from 11.0% to 3.8%, below the 5.0% appetite, and turns green on the board dashboard for the first time.

11.4 Stakeholders

Some teams resisted deleting data they might use someday. Priscila listened to their needs and found that most could be met with aggregated statistics kept longer. She also explained the risk of keeping data unnecessarily, using the breach in Chapter 8 as an example. Dr. Ward notes that change management is often the hardest part of privacy projects, and that listening and offering alternatives is more effective than enforcing rules alone. Finance agreed to deletion once archived summaries were offered. That compromise unlocked the remaining systems.

Worked example

Priscila delivers automated retention, catches a legal-hold near miss, reduces records past retention from 11.0% to 3.8% and manages resistance with aggregated alternatives.

Synthetic case. The project and figures are synthetic.

Errors and limits

Lower retention figures can hide unindexed data stores; keep discovering.

Exercises

Synthesis

Chapter 11 delivers change. Chapter 12 reviews and transfers learning.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →