When to use
Use this when an organization has no existing privacy documentation and you must build the baseline from a blank page: no records of processing (RoPA), no data map, no vendor list. It is the discovery conversation that feeds every later artifact — RoPA, PIAs, DPAs, DSAR readiness.
Not for: organizations that already have a data map you can review (go straight to privl-reg-gap-analysis), assessing a single new use case (privl-use-case-triage), or answering a live request. If a RoPA exists, validate it rather than re-interview.
Method
- Frame the goal: you are mapping what personal data exists, why, where, and who touches it — not judging yet.
- Walk the data lifecycle with the interviewee: collection points → purposes → storage systems → internal access → external sharing → retention → deletion.
- For each flow capture: data categories, subject types (customers, employees, children), volume/scale, and any sensitive/special-category data.
- Enumerate systems and vendors: SaaS tools, sub-processors, analytics, payment, cloud region(s). Ask "where does the data physically live?" for transfer exposure.
- Probe legal footing per purpose: why are you allowed to do this? Note where no basis is articulated.
- Decision point: flag every flow with no owner, no retention rule, or undocumented cross-border transfer as a gap for follow-up.
- Attorney-escalation gate: if the interview surfaces active sensitive-data processing, children's data, or transfers with no mechanism, note it for counsel — do not opine on legality.
Example
Org: 30-person SaaS, no privacy docs.
Interview surfaces: signup + support + a Facebook pixel (undisclosed), data in US + EU cloud, HR data in a third-tool, no retention policy anywhere.
Output: 6 processing flows mapped, 4 vendors, 3 gaps (pixel undisclosed, no retention, EU→US transfer without SCCs). Routed transfer gap to counsel.
Pitfalls
- Accepting "we don't collect much" — shadow collection (pixels, logs, backups) is universal.
- Interviewing only IT and missing HR/marketing data flows.
- Recording systems but not the purpose — purpose drives lawful basis.
- Letting the interview become a legal opinion; you are gathering facts.
Output format
COLD-START MAP — <org> | date
Flow: <collection → purpose → system → sharing → retention>
data: <categories> | subjects: <type> | scale: <n> | sensitive: <y/n>
Systems/vendors: <list + region>
Basis (stated): <per purpose or "none articulated">
Gaps: <no-owner | no-retention | transfer | undisclosed>
For counsel: <items>
Reference
- GDPR Art. 30 records of processing — the RoPA fields this interview populates.
- GDPR Art. 6/9 lawful bases and special-category conditions to probe per purpose.
- Chapter V international transfers (SCCs/adequacy) — capture data location for later analysis.
- Escalate active sensitive/children's-data or unmechanized transfers to an attorney.
1---2name: privl-cold-start-interview3description: Run a structured intake interview to build a first data-processing picture for an org with no privacy program — surface data flows, systems, vendors, and legal bases from zero.4---56## When to use78Use this when an organization has no existing privacy documentation and you must build the baseline from a blank page: no records of processing (RoPA), no data map, no vendor list. It is the discovery conversation that feeds every later artifact — RoPA, PIAs, DPAs, DSAR readiness.910**Not for:** organizations that already have a data map you can review (go straight to privl-reg-gap-analysis), assessing a single new use case (privl-use-case-triage), or answering a live request. If a RoPA exists, validate it rather than re-interview.1112## Method13141. Frame the goal: you are mapping *what personal data exists, why, where, and who touches it* — not judging yet.152. Walk the data lifecycle with the interviewee: collection points → purposes → storage systems → internal access → external sharing → retention → deletion.163. For each flow capture: data categories, subject types (customers, employees, children), volume/scale, and any sensitive/special-category data.174. Enumerate systems and vendors: SaaS tools, sub-processors, analytics, payment, cloud region(s). Ask "where does the data physically live?" for transfer exposure.185. Probe legal footing per purpose: why are you allowed to do this? Note where no basis is articulated.196. **Decision point:** flag every flow with no owner, no retention rule, or undocumented cross-border transfer as a gap for follow-up.207. **Attorney-escalation gate:** if the interview surfaces active sensitive-data processing, children's data, or transfers with no mechanism, note it for counsel — do not opine on legality.2122## Example2324> **Org:** 30-person SaaS, no privacy docs.25> Interview surfaces: signup + support + a Facebook pixel (undisclosed), data in US + EU cloud, HR data in a third-tool, no retention policy anywhere.26> **Output:** 6 processing flows mapped, 4 vendors, 3 gaps (pixel undisclosed, no retention, EU→US transfer without SCCs). Routed transfer gap to counsel.2728## Pitfalls2930- Accepting "we don't collect much" — shadow collection (pixels, logs, backups) is universal.31- Interviewing only IT and missing HR/marketing data flows.32- Recording systems but not the *purpose* — purpose drives lawful basis.33- Letting the interview become a legal opinion; you are gathering facts.3435## Output format3637```38COLD-START MAP — <org> | date39Flow: <collection → purpose → system → sharing → retention>40 data: <categories> | subjects: <type> | scale: <n> | sensitive: <y/n>41Systems/vendors: <list + region>42Basis (stated): <per purpose or "none articulated">43Gaps: <no-owner | no-retention | transfer | undisclosed>44For counsel: <items>45```4647## Reference4849- **GDPR Art. 30** records of processing — the RoPA fields this interview populates.50- **GDPR Art. 6/9** lawful bases and special-category conditions to probe per purpose.51- **Chapter V** international transfers (SCCs/adequacy) — capture data location for later analysis.52- Escalate active sensitive/children's-data or unmechanized transfers to an attorney.
Matrixx0070