What should be the first major goal of a company developing a new privacy program?

The first major goal when developing a new privacy program is to establish its strategic importance and secure organizational buy-in. Scheduling conversations with executives of affected departments is a critical foundational step. This engagement helps the privacy leader understand business objectives, identify key stakeholders, assess the organizational context, and align the privacy program's vision with the company's overall strategy. This top-down approach ensures the program receives the necessary authority, resources, and cross-functional support to be successful. Without this initial stakeholder engagement, any subsequent tactical efforts would lack the necessary foundation and support.

A. Surveying potential funding sources is a necessary but subsequent step. A budget cannot be accurately developed until the program's scope and requirements are understood through stakeholder discussions.

C. Identifying third-party processors is a tactical data-mapping activity. This is part of the program's implementation phase, which follows the initial strategic planning and governance setup.

D. Creating policies and procedures is a core implementation task. Effective policies cannot be drafted without first understanding the business processes and gaining consensus from the relevant departments.

---

1. IAPP. (2019). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.). In Section 1.3

"Establish a Governance Model

" it is emphasized that "The privacy team must understand the organization and its data to be effective... This requires building relationships with business units" (p. 34). This directly supports engaging with department leaders as a primary step.

2. IAPP. (2021). Certified Information Privacy Manager (CIPM) Body of Knowledge. Domain I

"Privacy Program Governance

" Section B

"Establish a Privacy Program

" lists foundational tasks such as "Identify stakeholders to participate in the privacy program" and "Establish data governance

" which are accomplished through executive conversations.

3. IAPP. (2019). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.). The text explains that creating a privacy vision and mission statement is an initial step

which requires understanding the "business alignment" and "organizational objectives" (p. 25). This understanding is gained by communicating with business leaders.