CDO – J. Howard, CDO & CPO

CCPA, CDO, CPO, GDPR, IAPP, Information Management and Governance, Privacy, Risk management

Beyond the Blind Spots: How a Privacy Partner Operationalizes Compliance

March 9, 2026March 9, 2026 James Howard

In mid-sized organizations, privacy responsibilities are often assigned to the IT Director, CISO, or General Counsel. These roles bring deep expertise in technology, security, and legal compliance. However, privacy introduces an additional discipline that focuses on how information is used, whether that use aligns with stated purposes, and how those decisions are operationalized across systems.

Two structural challenges commonly emerge:

Privacy governs data use, not only data protection.
As privacy regulations expand and organizations increase their use of AI and data-driven systems, compliance depends on clearly defined purposes, permissions, and lifecycle controls—not solely on security safeguards.
Regulatory obligations require repeatable operations.
Many privacy requirements depend on consistent execution (e.g., responding to individual rights requests, maintaining processing records). When these activities are handled manually or distributed across functions, they create operational risk and inefficiency.

As a result, privacy increasingly functions as an operational capability rather than a policy-only responsibility.

In this environment, organizations often supplement internal expertise with external privacy partners to address gaps between regulatory interpretation and system-level execution. These partners do not replace internal accountability, but support leadership by translating privacy requirements into operational processes aligned with existing IT, security, and business workflows.

In this context, privacy is no longer limited to published notices or contractual language. It is a data lifecycle and systems management challenge requiring coordinated execution across legal, technical, and business teams.

Governance Context: Roles and Accountability

From a governance perspective, privacy responsibilities typically align with a Three Lines of Defense model:

First Line (Business & IT Operations):
Own data use, system design, and day‑to‑day processing activities.
Second Line (Privacy, Risk, Compliance):
Define requirements, provide guidance, monitor adherence, and maintain oversight documentation.
Third Line (Audit / Independent Assurance):
Validate that privacy controls and processes operate as designed.

Where organizations lack a dedicated internal privacy function, an external privacy partner commonly supports the second line by providing subject‑matter expertise, standardizing processes, and supporting oversight without assuming operational ownership.

1. Operationalizing Privacy Requirements

Regulatory requirements must be translated into documented, repeatable processes. Without this translation, organizations rely on ad hoc responses when regulators, customers, or partners request information.

In practice, external privacy expertise is often used to help establish these processes in a consistent and auditable manner.

Key operational areas include:

• Record of Processing Activities (ROPA)
A compliant ROPA requires more than an inventory of systems. It must link data sets to processing purposes, legal bases, and retention decisions. Where internal teams maintain fragmented documentation, external privacy support can help normalize ROPA structures and ensure alignment with actual system behavior. When purposes change or expire, associated data should be reviewed and disposed of to reduce long-term risk.

• Data Subject Requests (DSRs)
Rights such as access, deletion, and correction are time-bound and resource-intensive when handled manually. Standardized workflows—often designed with external privacy input—can support consistent intake, identity verification, and fulfillment across systems while improving response reliability and cost predictability.

• Consent Management
Consent requirements span websites, mobile applications, CRM systems, and marketing platforms. Effective consent management depends on synchronized preferences and a consistent source of record. External privacy expertise is frequently used to help define consent governance models and ensure downstream systems respect user choices across platforms.

• Privacy Impact Assessments (PIAs / DPIAs)
PIAs are most effective when conducted early in the system development lifecycle. Privacy specialists—internal or external—can assist development and product teams by identifying risks at design time, enabling mitigation through architectural decisions rather than post‑deployment remediation.

• Data Minimization and Disposal
Retention decisions affect legal exposure, breach impact, and discovery obligations. Operationalizing retention and disposal policies often requires coordination between legal, IT, and security teams. External privacy support can help align retention rules with technical enforcement mechanisms to ensure policies are applied consistently.

2. Privacy Technology and Tool Selection

When privacy responsibilities are distributed across functions, tool selection is often fragmented. Different stakeholders may prioritize integration, reporting, or usability, leading to overlapping or underutilized solutions.

A coordinated approach to privacy tooling—frequently supported by external privacy advisors—focuses on selecting and integrating platforms that support:

Governance, risk, and compliance reporting across jurisdictions
Automated data discovery and classification
Scalable fulfillment of individual rights requests
Integration with development, security, and IT service workflows

The primary objective is not tool adoption itself, but operational integration. Privacy activities should surface within existing workflows and control environments so that compliance obligations are met as part of normal operations rather than through parallel processes.

3. Privacy in AI and Advanced Analytics

As organizations deploy AI and machine learning systems, privacy considerations increasingly intersect with model development, data governance, and risk management.

Key considerations include:

Documenting data provenance and permissible use
Assessing whether training and inference data align with stated purposes
Evaluating risks related to repurposing, bias, and downstream use

Given the evolving regulatory environment, organizations frequently rely on specialized privacy expertise to support AI impact assessments and governance reviews. These assessments help leadership determine whether proposed data uses are permissible, defensible, and sustainable over time.

Summary

Assigning privacy responsibility without dedicated operational ownership can introduce long-term compliance and operational risk. Whether delivered internally or supported by external expertise, a structured privacy function enables:

IT teams to design and operate systems with clear data‑use constraints
Security teams to reduce exposure through minimization and controlled access
Legal and compliance teams to rely on documentation that reflects actual operational practices

When privacy requirements are embedded into systems, governance structures, and risk frameworks, organizations are better positioned to respond to regulatory inquiries, support data‑driven initiatives, and adapt to evolving legal standards.

CCPA, CDO, CPO, GDPR, IAPP, Privacy, Risk management

Building a Simplified Privacy Program in Business

October 23, 2025 James Howard

The rules around protecting the privacy of customer and employee data are becoming one of the most complex business risks (not necessarily highest risk). With no single federal law, organizations face a complicated patchwork of state regulations (like those in California and Virginia), all while new Artificial Intelligence (AI) rules are beginning to overlap and add even more complexity.

This paper cuts through that complexity. It presents a simple, practical framework for a modern privacy program, focusing on the essential “what” must be achieved, not the highly detailed “how.” The goal is a program that is easy to understand, aligned with business strategy, and nimble enough to keep up with the law.

Three Pillars of a Resilient Privacy Program

To ensure continuous compliance, managing risk, and ready to respond, privacy programs can be thought of as built on three essential, functional pillars: Steady State, Change Management, and Response.

I. Steady State: The Foundation of Continuous Compliance

This pillar is about maintaining a clear, current understanding of what data is on hand and what can be donr with it. It focuses on the recurring activities that maintain compliance day-to-day.

Key Component	What It Does for the Business
Inventory of Data and Processes	What personal data is collected, why, and where is it stored. What permissions are attached to it? This is the single most critical piece of information, as it dictates all other requirements (e.g., disposal deadlines, security needs).
Inventory of Obligations	A clear view is needed of all applicable regulatory requirements (e.g., state laws) and contractual agreements (e.g., what promises are made to clients or what vendors commit to do).
Third-Party Risk Management (TPRM)	Vendors and partners are a disproportionate source of privacy risk. A formal process is needed to assess how they handle data, which is often overlooked in favor of standard IT security checks.
Risk and Controls	Areas of greatest exposure must be identified and proportionate safeguards in must be put in place. This includes employee training and technical controls to limit who can access sensitive data.
Incident Response	A formal plan for responding to privacy breaches or misuse of data is essential. This allows for quick action, remediation of vulnerabilities, and the ability to meet strict regulatory notification deadlines to minimize reputational and financial harm.

II. Change: Integrating Privacy by Design

This pillar proactively manages new risks that emerge in connection with new products, services, or large projects. It ensures that privacy is a fundamental design element, not a reactive checklist at the end.

Key Component	What It Does for the Business
Privacy Impact Assessments (PIAs)	This is the mandatory checkpoint for “Privacy by Design.” It’s a formal analysis to determine if a new initiative poses a high risk, ensuring the Privacy team is engaged early in the development cycle, long before launch.
Regulatory Change Management	The legal landscape is constantly changing. It suggests a formal process to monitor new laws, determine their impact, and implement necessary control changes before they take effect.
Process and Control Changes	A mechanism to engage the privacy team when business or IT process changes impact how personal data is handled. This prevents unauthorized, or “shadow,” changes from introducing new vulnerabilities.

III. Response to Inquiry: Demonstrated Accountability

This pillar focuses on the auditable evidence and response mechanisms that prove the program is working and demonstrate transparency to both regulators and data subjects (i.e., customers/employees).

Key Component	What It Does for the Business
Data Subject Rights (DSR) Management	People have a legal right to ask us what personal data an organization has have on them and how they’re using it. This drives the need for a streamlined, auditable workflow to intake these requests, verify identities, and fulfill them within strict regulatory deadlines.
Regulator Requests	On occasion, a regulator may inquire about a privacy program. Having a clear response plan is necessary to efficiently provide the required evidence and documentation, often leveraging the data from the Inventory and the DSR process.
Measurement and Continuous Improvement	Tracking certain operational metrics is key (e.g., number of incidents, time to fulfill DSRs) to monitor the effectiveness of the program and identify areas that require management focus and resource investment.

Executive Summary

The growing complexity of US privacy law demands a highly organized and resilient compliance framework. To navigate this challenge, we must focus on structure (the three functional pillars), process management, and enabling technology.

By proactively investing in and leveraging specialized privacy technology platforms, management of these intricate requirements can be automated. This approach achieves defensible compliance while keeping operational costs managed, allowing the business to drive forward with reduced risk.

CDO, CPO, IAPP, Information Management and Governance, Information protection, Privacy

Looking Ahead: The New Operating Model for Business

May 2, 2020May 2, 2020 James Howard

COVID-19 has had a horribly disruptive effect on almost all people and aspects of society. This paper starts a dialog around an admittedly tiny aspect of that and a view to the future. It in no way should be seen to marginalize or trivialize the pain and suffering endured by the millions of people directly impacted by the pandemic.

On May 1^st, CNBC published this article that discusses how some businesses are re-evaluating their need for physical office space in light of their experience with a majority of their workforce working remotely.

The rapid shift to work-from-home has served as a catalyst for change. Many years ago, when video conferencing first became available, companies started to invest in equipment that was office-bound, hoping to reduce business travel. That never happened because the technology was temperamental, brands didn’t interoperate very well, there were never enough facilities, and the equipment required expensive point-to-point T1 lines.

Since then, there were advances in the technology along many orientations, including high speed internet to homes, corporate adoption of laptops, smartphones, and importantly, audio conferencing. This enabled a shift toward work-from-home, and corporate shared office space – “hoteling” (universally adopted by consulting firms and hated by employees), smaller offices/cubicles sold euphemistically as “open concept” workspaces. But many were still reluctant to use video (Dilbert summed it up well with a series of comics depicting people “working from home” taking video calls wearing their bathrobes). Workers were far more comfortable with audio conferencing than video, but it still did a lot to get companies and workers more used to remote working.

The needle moved further toward remote workforce with the dramatic increase in off-shoring, leverage of contractors which in itself lessened the feeling of permanence of employment, and perhaps contributed to workers feeling more comfortable as individual contributors working from anywhere. Paradoxically, there was a simultaneous shift toward urban living, as the number of young people wanting to drive or commute went down, which one might have thought would shift them back to offices.

Powerful Disruptor

All these shifts were gradual, and the net result was tidal shifts in the work model. Leave it to nature to provide a dramatic disruption, which has resulted in remote working suddenly accounting for 95+% of non-essential workers. The points raised in the CNBC article are not at all surprising, given how the experts are bracing for periodic reemergence of Corona, but are also supported by:

The high cost of commercial real estate and the need to manage costs
The remarkable advances in technology enabling remote working
The quality of life impact of time-wasting commutes

A shift to predominantly remote working has immediate benefits, including the opportunity to hire the most qualified workers without regard to their physical location, which helps address challenges businesses have faced hiring the right talent. It also has consequences, such as the inevitable glut of empty office space. The sudden reduction in the concentration of office workers has a significant impact to businesses relying on them – restaurants, shops, laundry, shoe-shine, even metropolitan transportation – as large portions of their customers stop coming.

Opportunities

In the past, there have been dramatic disruption to business leading to the shrinkage or elimination of entire industries. Yet over time, business comes charging back. Before Corona, unemployment was at record lows, and companies were clamoring for skilled workers. This is after gloomy predictions of unemployment after waves of off-shoring everything from manufacturing to call centers to highly skilled workers.

What has to happen for remote working to become as effective as working from a managed location?

Physical space: Many people don’t have home offices and take over the dining room table instead. This isn’t sustainable, since asking people to shift from a company managed location to home involves a level of disruption and the only financial beneficiary is the employer. Wouldn’t it make more sense for the employer to provide each employee a remodeling budget (funded by savings resulting from reduced commercial real estate costs)? Small contractors could build-out home offices based on guidelines or specifications defined by the employer.

Technology infrastructure: When someone works in an office, the employer provides a laptop and a portfolio of business applications, but also the infrastructure to provide access to those applications – physical connectivity, wi-fi, deskside support. They establish standards that they are able to support in a cost-effective fashion. This needs to be replicated in some fashion at home, at least for a portion of the workforce. It’s not realistic to expect the worker to solve all their home technology issues and not impact their efficiency. Solution? A ramp-up of home technology service-providers (e.g., Geek Squad) who set up and support home offices.

Improved wireless: There is a race underway to roll out 5G infrastructure and public wi-fi 6 that promise high-speed performance that rivals (or beats) home-based/cable internet access. This may be a boon for remote workers and their employers because it simplifies the support model by eliminating the so-called “last mile” connectivity to the individual house in favor of a more controlled infrastructure using transmitters on towers in public spaces.

Comforts and conveniences: As people get used to working remotely, their appetite for convenience goods and services will likely return. This means the retail services that had been located near office buildings will cater to home-based workers. To be sure, it won’t look the same, given that the density of customers is different. There will be more home delivery or curbside service. Will it be the same in terms of volume? Probably in an overall sense, but the concentration will differ. But it seems reasonable that the businesses that can cater to distributed remote workers will benefit.

Challenges – Privacy and Data Protection – a tiny slice

There is no doubt that as with any fundamental disrupter, there will be challenges to be met before we move to equilibrium – the so called “new normal”. Among many others, information protection and privacy faces challenges. Some years ago, a colleague authored a prescient paper entitled “Privacy in a Pandemic” that explored the reasonable tradeoffs to be made when balancing individual rights against the needs of society, famously captured by Spock as he sacrificed himself believing “the needs of the many outweigh the needs of the few… or the one”. But the new equilibrium has implications for privacy and data protection in a more corporate setting. While privacy regulation accommodate these priorities, privacy and data protection programs will have to re-calibrate their risk assessments and place new weight on risks made more prominent by the shift away from office-based workers, to one where the line between personal life and professional activity is blurred to the point where you can hardly tell the difference. Clear desk policies went from being a constant real and philosophical debate to now being completely unenforceable, and therefore mostly moot. Implementing sound technical controls that don’t disproportionately interfere with the ability to work will take time, and likely require new technology deployments.

Understanding purpose: A key enabler to pivoting data privacy will be a mature data governance program. Making assumptions around higher level enterprise controls is no longer safe. Instead, knowing the nature and location of data is far more important in order to protect while enabling use. Providing more discrete permissions around the use of data will help lessen the risk of loss and unauthorized disclosure. Understanding the purpose behind proposed use of data will enable assigning more discrete permissions. Since preserving privacy is a lot more than just ensuring protection, the philosophy of understanding purpose also helps ensure appropriate use of data.

Fundamentals: Implementing new controls will take time and carries the risk of creating more frustration and confusion that benefit until the edges are smoothed out. Privacy leaders should step back and consider the full breadth of their programs, leveraging all techniques to manage risk while avoiding unnecessary disruption. An effective awareness program, for example, can go a long way to encouraging people to make safe decisions when handling data.

Summary

COVID-19 has created havoc in unprecedented ways, and has affected the lives of billions of people. The human toll cannot be measured, and the suffering by so many should not be swept aside. Experts are working through the optimal medical strategies while economists are still trying to model the short, medium and long term impacts to business. Entire books will be written and college classes will be structured around the Coronavirus pandemic. This paper has taken a very narrow slice of that and will hopefully start an open-minded dialog around how to help enable the future operating model for business. The dialog can and will continue in months and years to come.

CCPA, CDO, CPO, GDPR, IAPP, Privacy

Organizational Placement of Privacy

February 10, 2020 James Howard

Question for the community: where should a Chief Privacy Officer (or more broadly, the privacy function)? Some alternatives include:

Counsel’s office: Since privacy is a legal matter, it stands to reason that compliance would benefit from being embedded with the general counsel. On the other hand, counsel is often positioned as a separate function to demonstrate objectivity and independence from operations. Moreover, since lawyers are trained to look at situations through a legal-risk lens, they are sometime less able to “get to YES” and truly embed privacy in operations. Operations folks may look at their Legal colleagues in general as someone providing “sign-off” and that perception might extend to privacy compliance.
Risk Management & Compliance: again, the alignment has some logic, since privacy provides a set of requirements that overlaid on operational processes, and one should manage the risk of non-compliance. However, similar to assigning privacy to the Counsel’s office, Risk and Compliance are often organizationally separate to maintain objectivity and independence. As a result, there will likely be challenges in embedding privacy into operational processes to achieve Privacy/Data Protection by Design.
Office of the Chief Data Officer: The CDO is tasked with understanding the full breadth of data for purposes of deriving value and helping the organization leverage data in existing and new initiatives. As a result of developing and maintaining the inventory of an organization’s data, the CDO is in a natural position to assess the applicability of privacy requirements and embed privacy requirements in business processes. The challenges include that the CDO may be perceived has having a conflict of interests by owning privacy compliance as well as data leverage goals (in much the same way as a CIO has a conflict of interests by owning the CISO function). Another challenge is that CDOs don’t always own all data in the organization, instead focusing on the data to be leveraged or monetization. This leaves key gaps – such as employee data.
Office of the CIO or CISO: The CISO is tasked with protecting data and is often looked to when there are data incidents. As a result, the CISO has operational processes as it relates to embedding security requirements as well as monitoring/responding to issues, so adding privacy requirements would seem like a logical extension. Moreover, the CIO and CISO are very well versed at implementing tools and extensions, which will be required for an effective program. Privacy professionals will be quick to point out that privacy requirements extend well beyond security, and compliance requires a different level of understanding of the nature of data and how it’s used; a privacy breach may exist where no “traditional” security breach has occurred. Moreover, privacy requirements apply to information and processes across an organization – not just those within scope of the CIO. You could have an entire privacy awareness curriculum that never mentions technology, instead focusing on how people handle information.
Operations (COO): Having privacy report of the COO can make sense, depending on the organization. Whereas privacy has been around for many years, the passage of landmark privacy legislation – with significant consequences for non-compliance – has very quickly elevated its importance in organizations, making it a Board-level or C-suite priority in some cases. Having it report to the COO gives it prominence and positions it as aligning with the entire company. This helps enable the implementation of privacy processes as embedded components in business process. If done right, the result is a less disruptive but more effective program. The downside is that unless the organization is a very data-focused company, privacy may get lost among the COO’s other priorities, and may be the target of political struggles.

To be sure, any of these models can work, if provided with the appropriate leadership, support and oversight. Moreover, the culture of the company and the nature of their business can also influence an appropriate structure.

Privacy is at a crossroads. One the one hand, the emerging interest and concern from consumers (and therefore legislators) puts pressure on companies to acknowledge their responsibilities handling personal information properly. On the other hand, since privacy has been around for a while and is conceptually familiar to executives, is there a level of privacy fatigue being felt? As a result, are companies less motivated to address the risks, instead adopting a wait-and-see attitude?

CDO, Information Management and Governance

When do data-dependent startups need a Chief Data Officer?

January 29, 2019January 30, 2019 James Howard

More and more startup companies are exploiting business opportunities tied to data. Whether developing data-dependent AI, re-imagining how to conduct familiar business processes in innovative ways, or intelligently designing and building datasets drawing from a growing variety of sources. The common theme for this class of business is the reliance on, and exploitation of, data.

In the earliest stages, startups are focusing their energy and time on creating their product or service. As they begin to mature, they naturally start to move toward a state where they are returning value to their stakeholders – profits. Perhaps they plan an IPO or to be sold to an investor, or some other larger entity.

This paper explores options and approaches that companies could consider to determine if and when they should appoint a Chief Data Officer (CDO), as well as their scope of responsibilities.

What kind of startups should prioritize appointment of a CDO?

At some point in their lifecycle, any company that is dependent on data will need to implement data management processes. These include processes to acquire, ingest, catalog, track and at some point, dispose of data. If the data is licensed or belongs to others, they will need to understand and comply with applicable obligations. They will need to create a data architecture, build repositories and apply appropriate controls to protect the data.

This description admittedly covers a lot of scope. So the following adds a little structure to the thought process:

Does the startup…

Handle large volumes of data?
Have data as core to it’s business, where completeness, accuracy and currency are critical?
Have products and services that are dependent of data, but are themselves not data products? (e.g., a website or app with data in the back-end vs. a licensed database)
Need data that is licensed or procured from others?
Use personal data (PII) or health data (PHI)?
Need to demonstrate data lineage or provenance?
Create new data, which has intrinsic value?
Live with the risk that a data incident could cause irreparable harm?

If the answer to many of these are Yes, then the company should consider appointing a CDO. Moreover, if the company wants to go public or be bought by another company – especially a public company where the transaction is material, the startup may be expected to demonstrate discipline around the treatment and protection of data, including documented policies and procedures. While a CDO isn’t necessary to do this, a CDO can design and implement practices and disciplines that will provide comfort in a due diligence setting, and integrate those disciplines into the daily business routine of the startup.

What value can a CDO provide to a startup?

Removing Barriers:

A CDO can provide a range of value to a startup. The CDO looks at a company’s business through the lens of data, and is sensitive to both the value (revenue) cycle as well as the risks and obligations, recognizing they go hand-in-hand. From this vantage point, they can enable the business by sourcing data and removing barriers, and can implement right-sized controls, proportional to actual risks and obligations. In effect. they can enable the data scientists – who seem to always “need…more…data…” – by providing relevant data, aligned with business objectives, where obligations and risks are managed elsewhere. Call it “unencumbered data”.

Scientific Method:

A CDO understands and recognizes the transformative potential of data, but also a balanced sense of proportion – especially when resources are scarce. By implementing structure around the activities of data scientists, a CDO can improve the chances that research will be fruitful and aligned with business objectives – with a necessary degree of transparency for stakeholders.

Protection and Compliance:

Most information that companies want to use will have some kind of requirements around handling. These will emanate from one or more of the following:

The data is regulated; many data projects will incorporate information about people — PII or PHI — likely controlled by one or more regulatory frameworks (e.g., GDPR, CCPA, GLBA, HIPAA/HITECH)
The data belongs to others and is governed by a contract or Data Use Agreement
The data is valuable and needs to be protected – these protections might be present as a result of the data being regulated.
A breach of the data could result in harm or loss, either to the company or to data owners, and should cause the company to respond in a certain way.

The CDO, who should understand the nature of data, can work with the CISO and counsel to implement proper controls to protect the data and comply with requirements.

Ethics:

By understanding the business and compliance perspectives of data, the CDO can provide perspective on the ethics of data use. So much of the new digital economy is exploring uncharted territory, where potential uses haven’t yet been imagined. There are lines not yet drawn around what industry should do, even though they can do it. Data-driven inventions can cause real or perceived harm to consumers as they disrupt industries. Whether its financial services, advertising/marketing, insurance, consumer electronics, or the breadth of online applications and properties. Data is central to these and a misstep can be catastrophic.

Optics:

Transparency is a cornerstone of the capital markets. And while data-driven startups are inventing new ways to conduct business and benefit consumers, much of it is betting on the future. With so many unknowns, appointing a CDO can help inspire confidence that a data-dependent startup is approaching their objective with a view to managing their data assets for the longer term.

What can a CDO do?

85% of the time, “Big Data” initiatives fail to meet their objectives, and 50% of startups fail in the first year. Start-ups relying on data can’t afford many false starts. The CDO can spearhead data management activities that can, in aggregate, reduce risk of project failure and increase the likelihood of achieving the desired outcome. These might include

Vision and strategy, involving leaders across the company
Data inventory
Data architecture
Data acquisition
Data maintenance and quality
Data retention and disposition,
Risk assessments, protection and compliance processes

While these are not necessarily discrete activities, and should certainly be scaled to the situation, having a framework in place would be very useful to (1) enable growth, (2) permit introduction of different data sets, and (3) give Boards of Directors, auditors, reviewers and regulators a level of comfort that the company takes data management seriously.

Balancing cost vs value? Alternatives…

Many early stage startups are focused on laying out the important initial groundwork to sustain themselves — developing products, recruiting talent and identifying customers. As they move through funding stages and become established, they might be looking toward aggressive growth, IPO and engaging in discussions to be acquired. This is a sliding scale – and it may not make sense to appoint a full-time CDO initially. Startups should consider engaging a consultant or a CDO on a contract basis to implement and appropriate framework. As time and circumstances evolve, the time commitment can be adjusted.

Who should drive the decision?

The role is so important and strategic, that the CEO should drive the decision to appoint a CDO. The CDO should expect to work closely with the CEO, as well as the rest of the executive team. Moreover, the CDO should expect to meet with the investors and advisory board to reinforce the role and how it will help the company accelerate forward.

Conclusion

It goes without saying that startups leveraging data science are not at odds with managing data, or the scope of a CDO. They are extremely complimentary, to the point where an CDO can dramatically improve the probability of a data program, or data-dependent startup, succeeding.