Engagement Checklist

Print this before a client meeting. One page — the absolute minimum for scoping an anonymization engagement. Abbreviations: SDP = Sensitive Data Protection; DDM = dynamic data masking; ARX = structural anonymization tool.

Recognize the scenario

When you hear...	Think...	Start with...
"unlock data for analytics / ML"	Zone 2–3 needed	Map use cases to zones
"moving to GCP / cloud migration"	Landing zone opportunity	Design zones into the landing zone
"share data with partners"	Highest-bar scenario (Zone 3)	Assess recipient needs + composition risk
"our pseudonymization is a lookup table"	Legacy modernization	Audit against 12-mistake checklist
"regulator asking questions / audit"	Documentation gaps	Inventory existing evidence

The 5 discovery questions

Ask these before making any recommendation:

• 1. What data, where? Systems touching PII, field classification (direct/quasi/sensitive), data flows
• 2. What regulations? GDPR, ePrivacy, sector-specific (AMLD, PCI-DSS, national telecom law), jurisdictions
• 3. What have you done? Current anonymization, key/dictionary storage, access controls, QI treatment
• 4. What for? Use cases → zones: operational (Zone 0), internal analytics (1–2), external sharing (3)
• 5. What's driving it? Regulatory deadline, business opportunity, or modernization? Who's the sponsor?

Red flags: No data inventory. "It's anonymized" without evidence. Dictionary-based pseudonymization. Single dataset for all purposes. No sponsor with budget.

3 quick wins (apply to every engagement)

Quick win	What it does	Effort
Add BigQuery policy tags + DDM rules	Immediate access differentiation on sensitive columns	Days
Enable SDP discovery	Catches unclassified PII across the data estate	Days
Run ARX risk analysis on current output	Quantifies re-identification risk — the number sells the program	Days

Deliverable mapping

Client needs...	Give them...	Template
Understand a technique	Technique one-pager	templates/one-pager-technique.md
Understand a regulation	Regulatory briefing	templates/one-pager-regulatory.md
Architecture recommendation	Architecture one-pager	templates/one-pager-architecture.md
Formal policy	Anonymization policy	templates/anonymization-policy.md
Current vs target state	Gap analysis	Follows discovery outputs
Measured risk	Risk assessment	ARX output + narrative

The presales argument by stakeholder

Talking to...	Frame as...
CDO / Head of Data	"Anonymized data unlocks cross-team analytics without per-use-case approvals"
CTO / VP Engineering	"Systematic architecture replaces ad-hoc PII handling — reduces ops burden"
CFO / Finance	"Enables data monetization and partner sharing. Reduces fine exposure."
DPO / Legal	"Documented policy + measured risk + audit trails = defensible compliance"
CISO / Security	"Structurally anonymized data limits breach blast radius"