How to use these data protection case studies

Each case study is structured the same way: context → problem → approach → controls implemented → outcomes → what to copy. Use them as building blocks for your own roadmap.

Case study template (quick scan)

Case study 1: CMP rollout + tag governance (marketing-heavy website)

Context: A mid-sized business runs paid campaigns, analytics, and multiple third-party embeds on a global website.

The problem

• Cookie banner existed, but new tags were added without mapping to consent categories.
• “Reject all” did not fully prevent non-essential scripts from firing.
• No single owner for tag governance; changes were ad-hoc.

Approach

1. Inventory all scripts, pixels, embeds, and vendors (including via tag manager).
2. Implement a CMP with category/vendor controls and enforce blocking before consent.
3. Create a “new tag gate” process: privacy review required before deployment.
4. Set a monthly scan + quarterly audit of consent behavior.

Controls implemented

• Consent categories with clear definitions (“necessary / functional / analytics / marketing”).
• Tag manager rules tied to consent states (block-by-default for non-essential).
• Change log for tag releases + approval record for new vendors.
• Regression test checklist for consent flows (accept / reject / granular).

Case study 2: Vendor risk & DPA standardization (SaaS + many processors)

Context: A SaaS company uses many processors (hosting, support desk, CRM, email, analytics, monitoring).

The problem

• Inconsistent DPAs and unclear sub-processor visibility.
• Procurement focused on price/time-to-sign, not data protection controls.
• No standard risk review or renewal check.

Approach

1. Create a vendor inventory with data categories and processing purposes.
2. Standardize vendor onboarding: DPA + risk tier + minimal security checklist.
3. Define renewal workflow and offboarding requirements (deletion evidence).
4. Escalate high-risk vendors to deeper review (security + legal + DPO).

Controls implemented

• Vendor tiering (low/medium/high) based on data sensitivity and business criticality.
• “No DPA, no production” control with a single contract template.
• Annual renewal review + sub-processor change monitoring.
• Offboarding checklist with data return/deletion confirmations.

Case study 3: Retention automation & deletion evidence (customer + support data)

Context: A service business stores customer records, support tickets, and operational logs across several systems.

The problem

• Retention rules existed on paper, but deletion relied on manual tasks.
• Data duplicated across exports and shared folders.
• No evidence trail showing deletion actually happened.

Approach

1. Define retention by data category (customer, support, logs, marketing).
2. Implement automation where feasible (auto-delete, anonymize, archive).
3. Reduce exports; introduce controlled reporting views instead.
4. Produce deletion logs and quarterly “retention effectiveness” reporting.

Controls implemented

• Retention schedule mapped to each system owner + technical mechanism.
• Deletion/anonymization jobs with timestamps and exception handling.
• Policy + change history (who changed retention rules, when, why).
• Quarterly validation checks (sampling + system reports).

Case study 4: Access reviews + least privilege (rapidly growing team)

Context: A growing organization expanded tools quickly (CRM, HR, analytics, cloud storage) and roles changed frequently.

The problem

• Over-privileged access built up over time (“everyone is admin”).
• Offboarding was inconsistent; accounts stayed active too long.
• No scheduled access review process.

Approach

1. Identify systems with sensitive data and privileged roles.
2. Enforce MFA for admins and remove shared accounts.
3. Implement a semi-annual access review for key systems with sign-off evidence.
4. Integrate access removal into HR offboarding (target: <24 hours).

Controls implemented

• Role-based access model (standard roles + admin roles).
• Access review report with exceptions, owners, and remediation tickets.
• Offboarding checklist with confirmation logs.
• Monitoring for exports and privilege changes.

Case study 5: Incident readiness & tabletop exercises (high dependency on vendors)

Context: A business relies heavily on cloud services and third-party processors for core operations.

The problem

• Incident response existed as a document but had never been tested.
• Unclear roles and escalation path during an incident.
• Vendor incident communication expectations were not defined.

Approach

1. Create an incident runbook with clear roles (triage, comms, legal, tech).
2. Define evidence collection and decision points (severity, notification, containment).
3. Run a tabletop exercise and track actions to closure.
4. Add vendor incident clauses and contact paths into vendor management.

Controls implemented

• Incident ticketing workflow with timestamps and decision documentation.
• Contact lists and escalation paths reviewed quarterly.
• Tabletop exercise output: gaps, improvements, owners, and deadlines.
• Vendor incident expectations (notification times, cooperation, evidence sharing).

Patterns & lessons learned across implementations

Across these data protection case studies, the same patterns show up again and again.

• Most failures are “drift”: new tags/vendors/roles get added faster than controls are updated.
• Ownership matters more than tooling: without owners and cadence, even good tools become shelfware.
• Evidence is the real KPI: if you can’t export logs or show approvals, maturity stays low.
• Start with exposure: marketing stack + key vendors + admin access + retention are the fastest risk reducers.

Implementation checklist (copy/paste)

Use this list to turn case study patterns into your own plan.

• We maintain a control register with owners, review cadence, and required evidence artifacts.
• We have a vendor inventory with DPAs, risk tiering, renewal checks, and offboarding requirements.
• We enforce consent choices technically (no non-essential scripts after “reject all”).
• We implement retention rules with system mechanisms (auto-delete/anonymize) and deletion logs.
• We run access reviews for critical systems and enforce MFA for privileged accounts.
• We have an incident runbook, escalation paths, and at least one yearly tabletop exercise.
• We track findings like operational issues (ticketed, prioritized, verified, closed).

Sources & further reading

Use official laws, regulator guidance, and recognized standards to validate your controls and evidence requirements.

1. Switzerland – Federal Act on Data Protection (FADP / DSG)
2. European Data Protection Board (EDPB) – guidelines & opinions
3. ISO/IEC 27001 – Information Security Management
4. ISO/IEC 27701 – Privacy Information Management
5. NIST Privacy Framework

Last updated: February 22, 2026 • Version: 1.0