Most organisations already do a lot right. Thought has gone into access, into retention periods, into who may see which data. What is missing is the record: the moment someone asks how a decision came about, which data went into it and who signed off, the searching begins.
This sharpens as more becomes automated. A person, too, cannot always recount afterwards which information they used, but with a system it is reconstructable, provided the system was designed for it. Without recorded data and model versions only approximation remains, and that rarely holds up in an audit.
Why it reaches the agenda late
Because it looks like a legal topic for a long time. It gets assigned to the lawyer or the compliance officer, while the answers sit in the systems and therefore with the people who build them. Those two groups usually only meet when a deadline or an audit comes into view.
The second reason is that it produces nothing you can show. There is no new functionality, only the assurance that something will not go wrong later, and that loses against almost any other project, until the moment it does go wrong.
What we do and do not do
Twentynext does not give legal advice and does not determine which frameworks apply to your organisation. That belongs with your legal or compliance function. What we do is the technical side: making sure the questions they ask can actually be answered from your systems.
How this plays out in government and non-profit is on the sector page.
