Policies matter only when responsibilities, systems and evidence align. Start with a real inventory of personal information, access, providers and retention rules.
Make controls repeatable
Assign owners, define review cycles, preserve evidence and connect privacy-impact assessments to project governance.