Preparation for something specific with a date on it: a new regime coming into force, a supervisory engagement, a certification, a customer audit. The scope is worked backwards from the deadline rather than forwards from an assessment, because the deadline is the only fixed thing in the exercise.
The problem this addresses
Readiness work fails in two directions. It starts too late, and becomes a documentation sprint that satisfies nobody who looks closely. Or it starts early and expands, consuming a year of the privacy team’s capacity on a programme whose scope nobody ever constrained.
The discipline is deciding what has to be true by the date, and what merely ought to be true eventually. Those are different lists, and conflating them is what turns a manageable deadline into an unmanageable one.
What the engagement covers
- An assessment of the requirement itself, and an honest reading of what compliance means in practice rather than on the face of the text
- Current-state position measured against it, limited to the areas in scope
- A plan sequenced against the date, separating what must be complete from what must be demonstrably underway
- The evidence pack: what you will be asked to show, and whether it currently exists
- Preparation of the people who will be in the room, where there is an engagement rather than a submission
- Where a requirement is genuinely ambiguous, a documented position and the reasoning behind it
What guidance says and what it means
Not every requirement carries equal weight, and published guidance rarely says which parts a regulator will actually examine. That judgement comes from having watched how these regimes are drafted, consulted on and then applied, including the distance between the intention behind a provision and the way it lands.
Applied properly, that reading saves more time than it costs. Most readiness overruns are caused by treating every clause as equally load-bearing.
How it runs
Fixed scope against the date, with a defined checkpoint pattern so slippage is visible early enough to do something about. Where the date moves, and it does, the plan is re-cut rather than compressed.
What you’re left holding at the end
A defensible position on the date, with the evidence assembled rather than described. Alongside it, a record of the judgements made and why, which is what you need if the requirement is later interpreted differently from the way you read it.