Review Cadence

How to run a quarterly privacy review

Audience: ops, privacy, founders, product, engineering, customer success · Last reviewed: March 2026

Most privacy issues do not begin as dramatic violations. They begin as drift. A new field gets added to onboarding. A support tool changes. A vendor expands access. Marketing starts collecting something nobody documented. A quarterly review is how you catch that drift before it turns into a credibility problem with customers, internal teams, or regulators.

A good quarterly review is not a legal memo. It is a cross-functional operating check that forces the business to re-verify data flows, notices, vendors, request handling, and unresolved edge cases.

What a quarterly review should cover

New or changed personal data collection points
Changes in vendors, subprocessors, or support tooling
Retention and deletion issues discovered in practice
Requests, complaints, and escalation patterns from the prior quarter
Whether public-facing notices still match the product and operations reality
Open risks that need leadership, legal, or engineering decisions

Who should be in the room

Keep the group small enough to make decisions and broad enough to catch reality:

Ops or privacy owner: runs the agenda and tracks actions
Product or growth lead: speaks to new forms, flows, and feature changes
Engineering or systems owner: confirms system behavior, logs, integrations, and deletion feasibility
Support or customer success lead: brings request, complaint, and customer diligence feedback
Legal or external counsel when needed: joins for interpretation-heavy or higher-risk items

A workable 60-minute agenda

Ten minutes: review open actions from the previous quarter
Fifteen minutes: confirm new data collection points and workflow changes
Ten minutes: review vendor or tool changes
Ten minutes: examine requests, complaints, and escalation patterns
Ten minutes: check whether notices, FAQs, and answer banks still match reality
Five minutes: assign owners, due dates, and escalation paths

Questions worth asking every quarter

Collection drift

Did we add fields, screens, integrations, or exports that changed what personal data enters the business?

Vendor drift

Did any new vendor, subprocessor, agency, or contractor gain access to meaningful personal data?

Execution drift

Did deletion, suppression, consent, or complaint handling expose any manual gaps or broken assumptions?

Messaging drift

Do our privacy notice, sales answers, and support replies still reflect what the systems actually do?

What to update after the meeting

Your privacy diligence pack and questionnaire answer bank
Vendor and subprocessor records
Data maps or inventory sheets
Retention and deletion notes
Request-handling SOPs and escalation matrix
Public-facing notices or support content if they are now inaccurate

How to keep the review from turning into theater

The easiest way to make a quarterly review useless is to keep it high-level. Bring evidence. Pull real support tickets. Review actual feature launches. Look at real vendor changes. If a team says “nothing changed,” ask what shipped, what tooling moved, and what customer questions came in since last quarter. Reality almost always changed somewhere.

When to trigger an off-cycle review

A large enterprise customer asks deeper diligence questions
You launch a new product area or onboarding flow
A serious complaint, incident, or request handling failure occurs
You onboard a new vendor with broader access than before
You start operating in a materially different risk posture

Source-aware review habits

The quarterly review is about operations, but it should still include a quick source check when the team is making or revising assumptions about duties, notices, or request handling. That prevents internal folklore from hardening into procedure.