Six initiatives. Six real plans.

Obligations with lead time

• Statutory2–6 weeks before go-live
  Execute the GDPR Article 28 data processing agreement with Microsoft/Azure, review the subprocessor list, and document the applicable GDPR Article 44–49 third-country transfer mechanism, transfer assessment
• Guide value2–4 weeks before go-live
  Update the GDPR Article 30 record of processing activities for Azure and Microsoft 365, including purposes, data categories, recipients, locations, retention, and security measures.
• Guide value4–8 weeks before go-live
  Determine and document whether NIS2 applies based on sector, services, employee count, turnover, and customer role. If applicable, document cloud risk management, incident handling, business continuity
• Required
  Implement GDPR Article 32 and internal security controls for the target environment, including MFA, least privilege, privileged-access management, encryption, secure configuration, vulnerability management
• Establish a documented backup, disaster-recovery, and business-continuity capability with workload-specific RTOs and RPOs, isolated backup protections, restore procedures, failover runbooks, monitoring

Biggest risks

• highIncomplete Inventory or Hidden Dependencies
  Mitigation: The Infrastructure and Operations Lead, Application Owners, and Migration Partner will perform automated discovery and dependency workshops, reconcile results with the CMDB
• highGDPR DPA or Third-Country Transfer Delay
  Mitigation: The DPO, Privacy Counsel, Legal, Procurement, and Vendor Management will begin negotiations and transfer assessments in Week 1, complete the required documentation by Week 8
• highNIS2 Applicability or Cloud Supply-Chain Gap
  Mitigation: The CIO, Legal Counsel, CISO, and DPO will document the sector, size, turnover, customer-service role, and NIS2 applicability decision by Week 2.

Stakeholders

Budget frame

Obligations with lead time

• Guide value2–4 weeks before go-live
  Document the GDPR Article 35 DPIA screening and decision. If the assessment identifies high-risk processing, complete and approve the DPIA and required safeguards before go-live.
• Statutory2–6 weeks before go-live
  Negotiate and sign a GDPR Article 28 data processing agreement with the ERP provider, covering instructions, confidentiality, security, subprocessors, breach assistance, data return/deletion, audit rights
• Required
  Update the GDPR Article 30 record of processing activities for ERP users, supplier/customer data, employee data, access administration, testing, migration, and support.
• Required
  Apply GDPR Article 32 security measures and the organization’s access-control policy: role-based access, least privilege, segregation of duties, administrator controls, authentication, logging, backup
• Required
  Consult the works council or employee representatives where required before introducing barcode activity monitoring, changing work organization, or materially changing employee workflows.

Biggest risks

• highPoor-Quality or Incomplete Master Data
  Mitigation: Data migration and master-data owners will approve data definitions, ownership, cleansing rules, and reconciliation criteria by Week 16.
• highProduction-Planning Fit Gaps
  Mitigation: The production planning lead and ERP provider will validate representative planning scenarios by Week 11, classify each gap as configuration, controlled extension, or process change
• highAccounting-Interface Failure
  Mitigation: The finance and accounting lead, IT integration lead, and ERP provider will approve the interface specification by Week 16, complete component tests by Week 21

Stakeholders

Budget frame

Obligations with lead time

• Statutory2–6 weeks before go-live
  Sign a GDPR Article 28 data processing agreement with the app provider, covering processing instructions, confidentiality, security, subprocessors, assistance with data-subject rights and breaches
• Guide value2–4 weeks before go-live
  Document the GDPR Article 35 DPIA necessity assessment for app-based employee time recording, including monitoring, location or device functionality, offline synchronization, and employee privacy concerns.
• Required
  Update the GDPR Article 30 record of processing activities for employee time recording, documenting purposes, categories of data subjects and data, recipients, retention, transfers, security measures
• Required
  Define and implement GDPR data-protection controls, including data minimization, purpose limitation, role-based access, secure authentication, retention and deletion rules
• Maintain internal change-control, payroll reconciliation, access-review, audit-log, incident-management, and fallback procedures in accordance with the company’s information-security, HR, and payroll policies.

Biggest risks

• highPayroll Integration and Working-Time Rule Errors
  Mitigation: The HR and Payroll Lead, supported by IT and the vendor, must document payroll rules and mappings in Weeks 1–2, complete interface and reconciliation testing in Weeks 7–8
• highGDPR Contract or Assessment Delay
  Mitigation: The Data Protection Advisor/DPO and Managing Director must review and negotiate the provider DPA during Weeks 3–6, sign it before any real-data testing
• highInsufficient Connectivity or Offline Capture at Construction Sites
  Mitigation: IT and the vendor must test offline recording, synchronization, duplicate handling, device recovery, and data timestamps at both representative sites by Week 8.

Stakeholders

Budget frame

Obligations with lead time

• Guide value1–2 weeks before the move
  Identify personal data, confidential client information, employee records, and storage media affected by the move; define access controls, minimization, retention
• Required
  Move files and storage media using a data-protection-compliant process or destroy them through a DIN 66399-compliant provider.
• Required
  Assess and document GDPR Article 32 security measures for the move, including restricted access, locked containers, tracked transport, secure temporary storage, device encryption where applicable
• Required
  Consult the works council or employee representatives where legally applicable, particularly regarding workplace changes, seating arrangements, hybrid-work rules, working conditions
• Apply the firm’s information-security, records-retention, access-management, incident-response, and business-continuity policies to the move.

Biggest risks

• highSupplier and Delivery Delay
  Mitigation: Finance and Procurement shall place priority orders and sign mover, furniture, and IT contracts by Week 7, obtain written delivery commitments by Week 8
• highIT, Telecommunications, or Access-Control Outage
  Mitigation: The IT and Network Lead shall complete installation and end-to-end testing by Week 12, maintain a tested temporary internet and remote-access solution
• highLoss or Unauthorized Disclosure of Confidential Information
  Mitigation: The Data Protection Officer and Records Owner shall classify and inventory records in Weeks 1–5, approve what is retained, securely transported, or destroyed by Week 13

Stakeholders

Budget frame

Obligations with lead time

• Statutory4–8 weeks before placing on the market
  Create, verify and approve the FIC label with mandatory particulars, emphasised allergens and nutrition declaration under Reg. (EU) 1169/2011.
• Statutory2–6 weeks before placing on the market
  Update and validate the HACCP plan for the new recipe, equipment and production process under Art. 5 Reg. (EC) 852/2004.
• Statutory1–2 weeks before placing on the market
  Notify a new site or changed activity to the food control authority
• Required
  Determine whether a new site or significant change in activity triggers notification under Art. 6 Reg. (EC) 852/2004.
• Required
  Complete documented shelf-life, storage-condition, pH/water-activity and microbiological validation, including assessment of applicable microbiological criteria under Reg.

Biggest risks

• highShelf-Life or Microbiological Validation Failure
  Mitigation: The NPD Manager and QA Manager will define pH, water-activity, microbiological and storage criteria by Week 6, use qualified laboratories for testing in Weeks 7–14
• highIncorrect FIC Label or Allergen Declaration
  Mitigation: The NPD Manager and Procurement Lead will lock the controlled formulation and supplier allergen declarations by Week 6.
• highHACCP Not Validated Before Commercial Production
  Mitigation: The QA Manager and Production Manager will update the HACCP study using scale-up trial evidence from Weeks 15–18, validate critical control measures and prerequisite controls

Stakeholders

Budget frame

Obligations with lead time

• Statutory2–6 weeks before go-live
  **GDPR Article 28 data processing agreements:** Identify every processor and relevant subprocessor, review security, confidentiality, audit, deletion, assistance, and international-transfer terms
• Guide value2–4 weeks before go-live
  **GDPR Articles 30 and 35:** Update the record of processing activities for the new shop, payment, hosting, analytics, inventory, and migration processing.
• Required
  **GDPR Article 32 security controls:** Document and verify access control, MFA, encryption, environment separation, logging, backup, vulnerability management, incident handling
• **Internal release, access, retention, and operational-control policy:** Approve the production access matrix, change-control process, support escalation, backup-retention approach, reconciliation ownership

Biggest risks

• highChristmas Deadline Slippage
  Mitigation: The E-commerce Product Owner shall freeze the minimum launch scope by Week 2, the Project Sponsor shall review milestone variance weekly from Week 3
• highInventory and Order Synchronization Failure
  Mitigation: The Inventory Integration Partner shall implement idempotent order processing, stock reconciliation, retry handling, and monitoring by Week 16.
• highPayment Launch or Settlement Failure
  Mitigation: The Finance and Payment Lead, Payment Provider, and Implementation Partner shall complete provider certification, test all payment methods and failure paths

Stakeholders

Budget frame