30-60-90 day plan for privacy officers
On this page
- What does a privacy officer own in the first 90 days?
- What does the 30-60-90 day plan look like?
- Which deadlines belong on a new privacy officer's deadline table?
- Which CCPA dates in 2027 and 2028 should the plan schedule?
- Which numbers should a new privacy officer baseline?
- What does "on track" look like at day 30, 60 and 90?
- A filled example
- How should the hiring manager use this plan in the final interview?
- What should the hiring manager ask at the check-ins?
- What the company owes a new privacy officer
- Common mistakes
- Adapting the plan
- Questions people ask
A 30-60-90 day plan for a new privacy officer should build a working data map and one table of every request and breach deadline in the first 30 days, test how requests are actually handled and review the vendors that receive personal data in days 31-60, and present a privacy program plan with owners and dates by day 90. As of November 2026 the plan also has to schedule California's new CCPA dates: rules on automated decisionmaking technology from January 1, 2027, risk assessments for existing processing by December 31, 2027, and the first submissions to the California Privacy Protection Agency by April 1, 2028. HIPAA covered entities add the privacy official rule, and companies with EU customers or staff add the GDPR.
This page is for the general counsel, chief compliance officer, CISO or CEO hiring a privacy officer, chief privacy officer, privacy program manager or HIPAA privacy official. The security side of an incident is in the 30-60-90 day plan for CISOs, the wider compliance program in the 30-60-90 day plan for compliance officers, and the legal function in the 30-60-90 day plan for general counsel.
What does a privacy officer own in the first 90 days?
- The data map: which systems hold personal data, about whom, for what purpose, shared with whom, where, and for how long.
- Individuals' requests: access, deletion, correction and opt-outs, answered on time and consistently.
- Notices: the privacy notices for customers, patients, website visitors, job applicants and employees, and whether they match what the company does.
- Vendors: contracts with the companies that receive personal data, and the terms the law requires in them.
- Reviews of new uses: risk assessments for new products, tracking tools and AI systems.
- Breach decisions: with security and legal, deciding whether an incident requires notice and to whom.
- Training for the people who handle personal data.
HR data is a common blind spot. California's law has covered job applicant and employee data since 2023, and recruiting tools, interview recordings and AI note takers all hold it; see CCPA and job applicant data and the CCPA ADMT rules for employers.
What does the 30-60-90 day plan look like?
30-60-90 day plan — [Name], Privacy Officer, [company]
Reports to: [general counsel / CCO / CEO] Start date: [date]
Laws in scope: [CCPA / other state laws / HIPAA / GDPR / ...]
Privacy team: [N] Request channels: [web form, email, phone]
Next report to leadership or committee: [date]
DAYS 1-30 — Map the data; build the deadline table
Goals:
- One-to-one with GC, CISO, CIO, HR, marketing, product,
customer service and procurement
- Read the privacy notices, past assessments, regulator letters,
complaints and every open request
- First data map: the 20 systems with the most personal data,
with data types, purposes, vendors, locations and retention
- Deadline table: every request, opt-out and breach clock that
applies, agreed with counsel
- Walk the incident path with the CISO: when privacy is called,
who decides on notice
Deliverables by day 30:
- Data map version 1 and deadline table
- Top risks as found, with evidence
DAYS 31-60 — Test the processes
Goals:
- Submit test requests through every channel and time each step
- Review contracts with vendors that receive personal data
against the terms the law requires
- List the processing that needs a risk assessment, an ADMT
review or a data protection impact assessment, with due dates
- Check every notice against the data map
- Plan training by role, including new-hire training
Deliverables by day 60:
- Request test results with fixes and owners
- Vendor gap list and assessment inventory with dates
DAYS 61-90 — Plan and report
Goals:
- 12-18 month privacy program plan with owners, budget, dates
- First privacy report to leadership in the format they will keep
- Fix the three highest risks found in month one
- Add a privacy review step to procurement and product launches
Deliverables by day 90:
- Plan approved by [reporting executive]
- Review step live in procurement
Check-ins: weekly with [manager]; reviews at day 30, 60 and 90.Which deadlines belong on a new privacy officer's deadline table?
The rules below are as they read in November 2026. Which apply depends on the company; state breach laws, other state privacy laws and contracts add their own clocks. Confirm the list with counsel; this is not legal advice.
| Rule | Deadline or requirement | Source |
|---|---|---|
| HIPAA privacy official | A covered entity must designate a privacy official responsible for its privacy policies and a contact person or office for complaints, and document both | 45 CFR 164.530(a) |
| HIPAA access requests | Act on a request for access no later than 30 days after receipt; one extension of no more than 30 days is allowed under the rule's conditions | 45 CFR 164.524(b)(2) |
| HIPAA breach notice | Individuals without unreasonable delay and no later than 60 calendar days after discovery; HHS at the same time for breaches of 500 or more, or within 60 days after the end of the calendar year for smaller breaches, which must be logged | 45 CFR 164.404(b); 164.408 |
| HIPAA documentation | Keep required policies and documentation for six years from creation or the date last in effect, whichever is later | 45 CFR 164.530(j)(2) |
| CCPA requests to know, delete or correct | Confirm receipt within 10 business days; respond within 45 calendar days, with up to 45 more if the consumer is told why | CCPA regulations, section 7021 |
| CCPA opt-out of sale or sharing | Stop selling or sharing as soon as feasibly possible and no later than 15 business days after the request | CCPA regulations, section 7026 |
| GDPR requests | Respond without undue delay and at the latest within one month | European Commission |
| GDPR breach notice | Notify the supervisory authority without undue delay and at the latest within 72 hours of becoming aware, where the breach is likely to pose a risk; tell individuals when the risk is high | European Commission |
| GDPR data protection officer | Required when core activities involve large-scale processing of sensitive data or large-scale, regular and systematic monitoring of individuals; public bodies always need one | European Commission |
The CCPA applies to for-profit businesses that meet one of its thresholds; the revenue threshold has been $26,625,000 since January 1, 2025, according to the California Privacy Protection Agency.
Which CCPA dates in 2027 and 2028 should the plan schedule?
California's updated regulations on automated decisionmaking technology, risk assessments and cybersecurity audits were approved on September 22, 2025 and took effect January 1, 2026, according to the agency's rulemaking page. The dates below come from the regulations text. A new privacy officer arriving in late 2026 has about a year to prepare for the first two.
| Requirement | Date | Section |
|---|---|---|
| ADMT rules for businesses already using it to make significant decisions about consumers | January 1, 2027 | 7200(b) |
| Risk assessments for processing begun before January 1, 2026 that continues | December 31, 2027 | 7155(b) |
| Submit risk assessment information for assessments done in 2026 and 2027 | April 1, 2028 | 7157(a)(1) |
| First cybersecurity audit report, for businesses that meet the audit criteria in section 7120 | April 1, 2028 (2026 revenue over $100 million), April 1, 2029 (2027 revenue of $50 to $100 million) or April 1, 2030 (2028 revenue under $50 million) | 7121(a) |
| Keep risk assessments | As long as the processing continues or five years after completion, whichever is later | 7155(c) |
The month-two assessment inventory is where these dates become work: each processing activity that needs an assessment gets an owner and a due date. Hiring tools are a frequent entry, because an employer using automated tools to make hiring decisions can fall under the ADMT rules.
Which numbers should a new privacy officer baseline?
The measures are examples. A privacy report to leadership should show the same few measures every quarter, not a list of activities.
| Measure (examples only) | What it shows |
|---|---|
| Requests received and closed within the legal deadline, by type | Whether the rights process works |
| Median days to close a request | How close the process runs to its deadlines |
| Systems mapped against systems known to IT | How complete the data map is |
| Vendors receiving personal data with compliant contracts | Exposure through third parties |
| Required assessments completed against due dates | Readiness for the 2027 and 2028 deadlines |
| Incidents assessed for notice, and days from discovery to decision | Whether breach decisions are made in time |
| Training completion for roles that handle personal data | Whether people know the rules they apply |
What does "on track" look like at day 30, 60 and 90?
| Checkpoint | On track | Worth a direct conversation |
|---|---|---|
| Day 30 | Data map covers the main systems, including HR and marketing; deadline table agreed with counsel; incident path walked with the CISO | A policy rewrite before the data map; has not met HR or marketing |
| Day 60 | Test requests timed through every channel; vendor gaps listed with owners; assessments inventoried with dates | Process described from the policy, not tested; vendor review limited to new contracts |
| Day 90 | Program plan approved; first report delivered; privacy review added to procurement | A long list of findings with no owners, budget or dates |
A filled example
Privacy officer: Priya Raman (invented), joining a home health and staffing company with customers in California and a HIPAA-covered home health division, as its first full-time privacy officer, reporting to the general counsel.
Day 30: The data map found interview recordings from the recruiting team kept in a video tool with no retention setting, and patient intake forms copied into a shared drive. Requests from the website form went to an inbox nobody owned.
Day 60: Two of five test requests were not acknowledged within 10 business days. She moved the form to a tracked queue with an owner. The vendor review found three vendors receiving customer data without the contract terms California requires; addenda went out. The assessment inventory listed a resume-screening tool for ADMT review before January 1, 2027.
Day 90: The general counsel approved an 18-month plan funding a request-handling tool and a retention schedule. Recordings older than the schedule allowed were deleted after legal confirmed no hold applied, and the first quarterly privacy report went to the executive team.
How should the hiring manager use this plan in the final interview?
Give every finalist the same brief: the laws in scope, the number of requests last year, the vendor count, the last incident and the reporting line. Score the plans with the rubric in how to evaluate a 30-60-90 day plan in an interview. A strong plan maps data before rewriting policies and puts the incident path in month one. Questions that test it:
- "A customer emails asking for every piece of data we hold. Walk me through the next 45 days."
- "The CISO reports a lost laptop with patient records. What do you need to know to decide on notice, and by when?"
- "Marketing wants to add a new advertising pixel to the website. What do you ask?"
- "HR wants an AI tool that ranks applicants. What review does it need before launch?"
What should the hiring manager ask at the check-ins?
- Day 30: Where is our most sensitive data, and who has it? Which deadline worries you most?
- Day 60: What happened to your test requests? Which vendors need new terms?
- Day 90: What will you fix first, what does it cost, and what are we ready for by January 1, 2027?
What the company owes a new privacy officer
- Direct access to general counsel, the CISO and the executive who owns the risk.
- The history: past requests, complaints, incidents, regulator correspondence and assessments.
- Authority to stop a launch or a vendor contract until a required review is done.
- A place in the incident path, written into the incident response plan.
Common mistakes
- Rewriting the privacy notice first. A notice written before the data map describes what the company should do, not what it does.
- Mapping only customer data. Employee, applicant and patient data often sit in tools no one reviewed.
- Testing the policy instead of the process. Only a real test request shows where requests get lost.
- Leaving 2027 for 2027. Risk assessments and ADMT reviews take months once the inventory is known.
Adapting the plan
- HIPAA covered entity: weight month one toward the privacy official duties, workforce training (new workforce members within a reasonable period after joining, under 45 CFR 164.530(b)), business associate agreements and the breach log.
- EU establishment or EU customers: decide whether a data protection officer is required and add records of processing and impact assessments, including for candidate and employee data.
- Privacy and AI combined: add an AI inventory and review step alongside the ADMT work.
- Credentials: the IAPP offers the CIPP (with U.S., European and other regional concentrations), CIPM for program management and CIPT for privacy engineering; weigh them alongside experience running requests and breach decisions.
Running a privacy program beside recruiting? The 30-60-90 day plan for HR coordinators covers the personnel files and retention calendar where applicant and employee data usually lives.
Questions people ask
What should a new privacy officer do in the first 30 days?
Meet general counsel, the CISO, IT, HR, marketing, product and procurement; read the privacy notices, past assessments, complaints and open requests; build a first data map of the main systems, the personal data in them, their purposes, vendors and retention; and put every request, opt-out and breach deadline that applies to the company into one table agreed with counsel. The CISO should also walk the new privacy officer through the incident path so both know when privacy decides on notification.
How long does a company have to answer a privacy request?
It depends on the law. As of November 2026, California's CCPA regulations require a business to confirm receipt of a request to know, delete or correct within 10 business days and respond within 45 calendar days, with up to 45 more days if it tells the consumer why. HIPAA gives a covered entity 30 days to act on a request for access, with one extension of up to 30 days. The European Commission says GDPR requests must be answered without undue delay and at the latest within one month. This is not legal advice.
Which CCPA deadlines fall in 2027 and 2028?
Under the CCPA regulations effective January 1, 2026: businesses already using automated decisionmaking technology for significant decisions must comply with the ADMT rules by January 1, 2027; risk assessments for processing that began before 2026 and continues are due by December 31, 2027; information about risk assessments done in 2026 and 2027 must be submitted to the agency by April 1, 2028; and the first cybersecurity audit reports are due between April 1, 2028 and April 1, 2030 depending on revenue, for businesses that meet the audit criteria.
What is the difference between a privacy officer and a CISO?
A CISO protects systems and data from attack and runs the security incident response. A privacy officer decides how personal data may be collected, used, shared and kept, answers individuals' requests, reviews vendors and new uses of data, and assesses whether an incident requires notice to individuals or regulators under privacy and breach laws. The two share the data map, the vendor list and the incident path.