P2P

P E E R T O P E E R M A G A Z I N E · W I N T E R 2 0 2 5 49 development cycle, rather than the traditional approach of completing the product and then proceeding with privacy review. Embedding privacy controls and reviewing privacy risks allowed teams to move projects forward as quickly as possible while still evaluating and mitigating potential risks in new products, services, and technologies. As part of this strategy, the privacy team was tasked with mitigating a backlog of privacy impact assessment inquiries from business units, while simultaneously promoting the visibility and accessibility of the enterprise-wide privacy program. The objective was to foster a positive relationship between privacy and business stakeholders, so that digital trust would be reinforced with consumers and privacy-by-design principles would be infused throughout the data lifecycle. For most organizations, attaining this kind of program and objectives is challenging. Internal constraints, lack of collaboration across teams, and perceptions that privacy reviews are burdensome often become roadblocks to the effective implementation of consistent data privacy practices. However, when privacy is made more approachable for the business and designed to serve as an enabler of growth, organizations can more effectively and sustainably uphold privacy- by-design principles across all business functions. There are several steps legal and data privacy teams can take to lay a strong foundation of privacy by design, particularly in fast-moving, innovation-driven environments. These include: • Streamline the privacy impact assessment process. Inquiries to the privacy team can accumulate quickly when development teams are working in sprints. Often, privacy impact assessment questionnaires are confusing or cumbersome for business teams, leading to unnecessary complexity, incomplete information, or time-consuming back- and-forth between teams. Privacy teams should work to establish a playbook that streamlines the privacy impact assessment process as much as possible. This will make it more accessible for development teams and allow assessments to be completed on time. • Establish standardized privacy impact assessments according to common use cases. To further

• Cover