How Assessment Interviews Reveal Hidden Privacy Risks You Never Expected
May 26, 2026
Why do themes start to emerge once you’ve conducted several assessment interviews?
When you speak with two, five, or ten people across different parts of the organization, patterns begin to surface. Some themes highlight strengths—practices worth scaling across the enterprise. But more often, the themes reveal unexpected risks that no one anticipated when the assessment began.
What kind of risks can surface during an assessment?
Sometimes the biggest risks have nothing to do with the original scope. In one project, we were focused on how newly acquired subsidiaries managed contracts. We expected to find inconsistent document practices—and we did. But the real risk emerged elsewhere.
What surprising issue did you uncover?
Developers were using live customer data to test product integrations. They weren’t acting maliciously—they simply liked the format and completeness of the data. But the volume of sensitive information being copied, moved, and stored on standalone machines created a massive, unrecognized privacy exposure.
Why was this such a serious risk?
Because the practice was:
- Unapproved
- Widespread across subsidiaries and the parent company
- Unmonitored, with no controls
- Unknown to privacy, legal, and IT leadership
This was nearly a decade ago—before today’s heightened privacy expectations—yet the risk was already significant.
How did the organization respond once the risk was identified?
Leadership immediately convened privacy attorneys, IT leaders, and product owners. Together, they conducted a structured risk assessment to evaluate:
- Likelihood of a breach
- Potential impact
- Organizational risk tolerance
They quickly concluded that tolerance for a large‑scale breach was near zero, and mitigation efforts needed to begin immediately.
Is this practice common?
Yes. In multiple assessments, we’ve found development databases full of personally identifiable information used for testing. It was considered “normal” at the time—but normal doesn’t mean safe.
If you want more information about this subject, please listen to What Counts, by TrailBlazer Consulting, Episode 9.
