Five questions to ask your data team

Why it works: every other promise your company makes about data - keeping it safe, deleting it, honouring consent - is impossible without knowing what and where it is. This question tests the foundation everything else stands on.

• A pass sounds like: "Here's the inventory - what we hold, where it lives, why we have it, who owns it. Updated last quarter." The formal version is called a record of processing; your practitioners build one in DPO session 3.
• The red flag: "It's mostly in the warehouse." Mostly is doing a lot of work in that sentence, and none of it is reassuring.

Why it works: holding data legally and using it legally are different things. This question tests the two promises from session 2 that trip companies most - consent and purpose. Data collected to deliver a service does not automatically become fuel for marketing, analytics, or your next AI feature.

• A pass sounds like: "Consent captured at signup, purpose statements on every form, records in the CRM - here's one." Openable records, tied to actual people.
• The red flag: "Users clicked accept at some point." At some point. On some version of some form. Covering some uses. That answer has funded a lot of regulatory enforcement.

Why it works: breaches are a when, not an if - so this question tests preparation, which is measurable, instead of prevention, which is a wish. Readiness also happens to be what regulators weigh most heavily after an incident.

• A pass sounds like: "There's a playbook, we drilled it in March, these three people run it, and the clocks are on the wall: assess within 30 days, notify the regulator within 3 if it's notifiable." Named roles, real rehearsal, deadlines known cold.
• The red flag: "IT handles security." A breach is a whole-company incident with a legal clock - the moment your team frames it as an IT matter, you know nobody has thought past the firewall.

Why it works: every record you hold is risk on the balance sheet - it can leak, be subpoenaed, or show up in a headline. Data you no longer need is risk with no offsetting return. This question tests whether anyone in your company ever deletes anything on purpose.

• A pass sounds like: "There's a retention schedule - this data type lives this long, then it's deleted, and here's the log showing deletion actually runs." The second half matters: schedules without deletion are decoration.
• The red flag: "Storage is cheap." Storage is cheap. Liability is not. That answer confuses the cost of keeping data with the cost of holding it.

Why it works: this is the thirty-second test from session 1, weaponised. Every strong answer to questions 1 through 4 depends on someone being accountable for each dataset. No owner, and every fix you fund this year quietly decays by next year.

• A pass sounds like: "Customer data - owned by the VP of Customer Success, stewarded day-to-day by a named person on her team. Here's the full owner list." Names, not org boxes.
• The red flag: "The data team." A team name is where accountability goes to hide. The data team runs the systems; owning what the data means and who may use it is a business job - and if it belongs to everyone, it belongs to no one.

Score one point per question answered confidently, with documents. Then the score tells you what to fund:

• 5 of 5: rare and excellent. Fund maintenance - governance decays without care - and re-run the interrogation annually so it stays true.
• 3 to 4: the healthy-company norm. You now know precisely which gaps to fund, which beats every consultant's assessment you could commission.
• 0 to 2: you have a program to start, not a crisis to panic over. The genuinely good news: most of your competitors would score the same - which means moving first is available.

And watch the texture of the answers, not just the count. Documents beat vibes, vibes beat shrugs. A team that says "here's the schedule, here's the log" has a system. A team that says "we're generally pretty careful" has a culture, which evaporates with its next resignation. A shrug is the most honest answer you'll get all day - it tells you exactly where the risk lives, free of charge.

What you just did informally, the industry does formally: capability maturity scoring. Frameworks exist for it - DCAM from the EDM Council is the best known - where a team self-scores each governance capability and repeats the exercise yearly to show progress. The full framework is member-gated, so we teach the concept honestly rather than inventing its contents; your practitioners get the scoring concept in DPO session 7. The exec version needs one sentence: ask your team for a one-page scorecard, refreshed annually - your five-question score is the napkin edition, and it is a perfectly respectable napkin.