TL;DR: Abiding by privacy law does not have to be treated only as a cost. The work of finding, describing and governing customer data can become an investment in the data platform itself.
The law
The California Consumer Privacy Act gave consumers the right to request access to their data and ask for it to be deleted. That sounds straightforward until you remember how many databases, spreadsheets, text files, vendors and business units a large company accumulates.
Finding the data is difficult. Returning it in a format a person can understand is another job entirely. Deleting it safely, while keeping the company functional and producing confirmation, turns the problem into a company-wide system.
The opportunity hiding inside it
I found myself working on exactly this kind of programme. What interested me was not only the compliance deadline. The discovery process forces an organisation to crack open its silos, identify what it collects and agree on how that information should be described.
The same artefacts needed for privacy can become the map for a better data platform.
Every business unit has to describe its data, its sensitive fields, its storage locations and the shape of the output it can provide. Combine those outputs and you begin to get something rare in an enterprise: a shared view of what customer data actually exists.
A practical operating rhythm
A project of this size needs a core team that can move across business units without losing the thread. We used a mixture of shared progress meetings, smaller working sessions and ad hoc problem-solving with the people who actually knew the systems.
The recurring work was surprisingly consistent:
- Locate databases, files and less obvious stores.
- Identify sensitive data points and unsafe collection patterns.
- Create or update a usable output schema.
- Find opportunities to minimise or obfuscate data.
- Design a repeatable access and deletion process.
The organisational bit is the technical bit
Most of the difficulty comes from history: old applications, stretched teams, undocumented decisions and people who carry vital context in their heads. You are taking an X-ray of the company while it is still moving.
That means empathy matters. The people who know the data are usually busy keeping the business running. A privacy programme that simply lands on their backlog will struggle. A programme that helps them understand and improve their own systems has a much better chance.
Privacy work can create a clearer customer schema, better lookup tables, stronger data ownership and a much more honest map of how information moves. The deadline gets the organisation into the room; good systems thinking makes the meeting worth it.