One company, one year.

On a Tuesday in July the managing director forwards a news item about a penalty order to Priya, who already handles audit and labour matters. His note is one line: are we covered? By lunchtime, privacy is her problem — with no legal team, no budget yet, and a law that has dates in it.

She does not start with a policy. She starts with thirty minutes of honest questions: what personal data does the company hold, whose is it, why is it kept, who else touches it. Twelve answers come back “not sure” — whether the courier gets full addresses or masked ones, whether the store CCTV footage is ever deleted, what the analytics vendor actually receives. She writes “not sure” instead of guessing, and every one of them becomes the first line of her work list.

At the end she has something she can take upstairs: a verdict in plain words. The Act applies, here is why, and here are the duties that come with it.

Priya does not walk into the board meeting with fear. She walks in with a plan and a price, and she leaves with three things: a mandate, a sponsor who controls budget, and a decision. The company will not hire a Data Protection Officer. It will rent one — a practice that serves as DPO for several companies, one morning a week each.

Appointing him is one act with two halves, and both have to happen in the same week. His name and contact go on the public notices, because customers must be able to see who answers for their data. And he gets a seat inside the workspace, because a person who is accountable on paper but cannot open the registers is a fiction.

They also settle the ownership question on day one, before any document moves: the workspace belongs to the company. The DPO may hold the keys while he builds it out, but they change hands before go-live. The accountability was never his to keep.

The split settles quickly, because each side can only do one half. The DPO brings judgment: the lawful basis calls, what a notice must actually say, how much retention is defensible, what an impact review should conclude. The company brings facts, because nobody outside the building can get them — which vendor holds the customer file, which store manager keeps a personal spreadsheet, which WhatsApp group nobody admits to.

He books a fixed Thursday morning. In that hour he works the gap board from the top; between sessions Priya chases the people who hold the answers. Progress has exactly one measure they both quote to the sponsor: fewer unowned gaps this week than last.

And from here on, every gap carries one name and one date. Not a department, a person; not “soon”, a date. A gap with no name is not an open item — it is a decision to keep the risk, taken quietly.

Mapping turns out not to be an IT exercise. It is a walk. The billing system, the CCTV folder, the courier’s export file, the loyalty app’s event stream, the spreadsheet a regional manager keeps because the report he needs does not exist — Priya writes down where personal data actually lives, not where the org chart says it should.

Then the duties, one at a time: notices and consent, security, retention, vendors, children’s data, cross-border transfers, grievances. Nothing heroic happens in any single sitting. One duty, honestly assessed, then the next — and each one ends the same way, in a short list of gaps with owners and dates on them.

Eleven weeks in, the picture is unglamorous and complete: what the company holds, why it is allowed to, who else touches it, and what still has to be fixed before anyone can call this compliant.

A customer in Hubli writes in asking what the company knows about her. It is logged the day it lands, Priya’s name goes on it, and a ninety-day clock starts running whether anyone looks at it or not. An erasure request a fortnight later travels further than expected — it has to reach the courier and the analytics vendor too, and the proof that it did is kept with it.

Retention dates fall due and data is erased on schedule, with the erasure logged rather than remembered. A grievance arrives and gets answered inside thirty days. Somebody withdraws consent and the processing stops within seven. None of this is dramatic, which is the entire point of building it before it was needed.

Every quarter Priya exports the dossier and reads it the way a regulator would: what is documented, what has gone stale, which duty has quietly stopped being done. The DPO signs off on the judgment calls inside it. When the sponsor asks what the retainer is buying, the dossier is the answer — and it is a better answer than a meeting.

Then the asking starts from outside. An enterprise customer sends a security questionnaire. An insurer wants to know how breaches are handled. A data principal’s lawyer writes a letter with dates in it. None of these are emergencies any more, because the answer already exists and does not have to be assembled under pressure — which is the difference between a company that complies and a company that can show it.

The arrangement holds because each side kept its half. The company kept the facts, the people and the accountability; the rented officer kept the judgment and the Thursday morning. Renewal, when it comes up, is the least interesting conversation of the year.