A Gantt is only as useful as its checkpoints. A Gantt without checkpoints is a mural. The 90-day DPDP engagement has exactly four checkpoints, and if you run them well, the programme navigates itself. Miss a checkpoint and the next three slip by a week each.
Checkpoint 1 — Day 15, "Stop or Go"
This is the most important of the four checkpoints and the one most consultants skip. By Day 15 the Phase A verb (find) should be complete. You have the scope document signed. The RACI is live. The data inventory is a draft, not final, but it exists. Discovery interviews are done with the primary stakeholder set.
At Day 15 you ask one question in the steering call: are the facts on the ground consistent with the scope document we signed on Day 0? If they are, you proceed to Phase B. If they are not, you reopen the scope.
Four examples of what I have seen trigger a scope reopen at Day 15. The company said it had one customer-facing product but discovery found three. The company said employee data was in-scope but HR will not share Workday access. The company said no sensitive data was processed but marketing has been uploading phone numbers to a WhatsApp Business API vendor. The company said the Singapore entity was out of scope but every cross-border transfer flows through the Singapore DNS. Any of these means the scope needs an amendment, not that the project is failing. The failure is pretending the scope is still accurate when it is not.
If you skip the Day 15 checkpoint, you spend Week 4 building a RoPA against an outdated inventory and Week 7 rebuilding it. Do not skip it.
Checkpoint 2 — Day 30, "RoPA and Retention Sign-Off" plus Board Update 1
By Day 30 the two foundational artifacts are complete. The RoPA, built off the Day-15 inventory. The lawful-basis matrix and retention schedule, built off the RoPA. Both are presented in the steering call. The A column of the RACI signs off each row by name.
Sign-off is not "yes it looks fine". Sign-off is "yes, I accept that this is the record my organisation will present to a Data Protection Board officer if asked under Section 8" [L4-C1]. The language matters. You want the GC to say that sentence out loud. Record the meeting. Email the recording summary.
Day 30 is also the first Board update. Six slides, ten minutes. We write the Board deck template in Module 10. For now, remember: at Day 30 the Board sees the RoPA structure, the retention philosophy, and the risk register (preview). You are not asking the Board for a decision. You are keeping them in the loop so that at Day 60 and Day 90 they can approve what has already been socialised. Boards hate surprises. Pace the surprise.
Checkpoint 3 — Day 60, "Build Review" plus Board Update 2
At Day 60 the Phase B verb (produce) is complete. The Rule 3 standalone notice is live or staged [L4-C2]. The Section 6 consent flow is wired in staging. The DSAR intake and workflow are drafted and in staging. The vendor risk register is populated. Phase C has started with vendor DPA outreach in flight.
The Day 60 checkpoint is the first full audit dry run. You bring in either an internal audit lead or an external reviewer and walk through the artifacts as if the DPB had asked for them. The dry run surfaces the gaps you did not know you had. Expect to find three to five. That is normal. If you find none, your audit lead was being polite. Push harder.
Second Board update at Day 60. Same six slides, updated. Now the Board can see the notice (because it is live or imminently going live) and the Board can approve the retention philosophy formally. The ask is now narrower and specific: approve the retention schedule, approve the vendor DPA template, acknowledge the breach runbook. Three asks, three resolutions in the Board minutes. Programmes that get these three Board resolutions on paper by Day 60 almost never fail audit.
Checkpoint 4 — Day 90, "Handover and Audit File"
Day 90 is handover. The DPO 12-month calendar is live. The audit evidence file is assembled and indexed. The board deck template is handed to the DPO so she can run Board updates herself. The programme is officially the client's, not yours.
The handover meeting has one deliverable: the DPO can walk a hypothetical DPB officer through the whole programme in sixty minutes using only the audit evidence file. If she can, you are done. If she cannot, the file is incomplete and you have one more week of work, which is why you build in a one-week buffer between Day 90 and the final payment.
Day 90 is also the handshake moment where you offer the ongoing DPO-as-a-Service retainer or the Phase 2 engagement for the items you listed as out-of-scope in Field 2 of the scope document (Lesson 2). This offer is not pushy. It is a natural continuation. About 60 percent of clients take one or the other. The ones who do not are the ones you want to call in six months to ask how the first breach drill went.
Three activities that look sequential but can parallel-run
The naive Gantt runs every phase strictly serial: discover, then build, then harden, then install. In practice three activities can start earlier than they look, and the savings compound.
Vendor DPA outreach can start on Day 10, not Day 45. Vendors take four to six weeks to sign anything, so if you wait until Phase C to begin outreach, you are chasing signatures in Week 11. Start on Day 10 with a vendor-list dump from Procurement, send the Section 8(2) DPA template to the top ten vendors, and spend the next six weeks negotiating in the background. By Day 60 you have most signatures.
Breach runbook drafting can start on Day 20, not Day 60. The runbook does not need a complete RoPA. It needs a stakeholder list and an understanding of your incident-response team structure. Both exist by Day 20. Draft the runbook, run the Day-30 tabletop against it, iterate once, and by Day 60 you have a tested runbook instead of a first draft.
DPO 12-month calendar can be drafted on Day 60, not Day 85. The calendar is a repeatable rhythm. It does not depend on the specifics of this engagement. Draft it at Day 60, review with the DPO at Day 75, finalise at Day 85, operate from Day 90. This gives the DPO fifteen days of consultation time instead of five.
These three parallel-runs save about two weeks of calendar time across the engagement. In a programme where the hard constraint is one financial quarter, two weeks matters.
Sample: ABC Tyres 90-day Gantt (text view)
Below is the Gantt we would run for ABC Tyres, start date 15 October 2026, end date 12 January 2027. A real Gantt is a chart; the text view below is what a steering-call attendee reads to find out what week they are in and which deliverables are live. Study the overlaps. Discovery ends in Week 2, but vendor DPA outreach (Row 6) starts in Week 2 as a parallel-run. Breach runbook drafting (Row 8) starts in Week 3, not Week 9. Those two early starts are what makes 90 days feasible.
| Week | Dates | Phase / verb | Active deliverables | Checkpoint |
|---|---|---|---|---|
| 1 | 15-21 Oct | A — Find | Stakeholder interviews (all six). Scope doc signed Day 1. RACI drafted Day 3. | — |
| 2 | 22-28 Oct | A — Find | Data inventory draft (Row 1). Parallel-run: Vendor DPA outreach starts Day 10 (Row 6, top-10 vendor list from Procurement). Discovery questions reset per Lesson 5 Killer 1 counter-move. | Day 15 — Stop/Go (29 Oct). Scope reconfirmed or amended. |
| 3 | 29 Oct-4 Nov | B — Produce | RoPA build (Row 1). Lawful-basis matrix (Row 2). Parallel-run: Breach runbook drafting starts Day 20 (Row 8). Vendor DPA red-lines in flight. | — |
| 4 | 5-11 Nov | B — Produce | Retention schedule (Row 2). Rule 3 notice copy drafting (Row 3) begins. HR employee inventory (Row 9) begins. | — |
| 5 | 12-18 Nov | B — Produce | RoPA and retention schedule freeze. Rule 3 notice legal review (Row 3). Vendor DPA count: aim for 5 of 10 signed. | Day 30 — RoPA sign-off + Board Update 1 (13 Nov). |
| 6 | 19-25 Nov | B — Produce | Consent flow wiring (Row 4) in staging. DSAR intake form (Row 5) build. Breach runbook v1 complete; tabletop scheduled. | — |
| 7 | 26 Nov-2 Dec | C — Pressure-test | Rule 3 notice goes live. DSAR workflow (Row 5) staging. Marketing tracker reseq (Row 10) decision locked. Vendor DPA count: aim for 8 of 10. | — |
| 8 | 3-9 Dec | C — Pressure-test | Tabletop breach exercise run and recorded (Row 8). Cross-border register (Row 7) populated. DPIA scoping if SDF-triggered. | — |
| 9 | 10-16 Dec | C — Pressure-test | Audit dry run preparation. Consent flow production cutover plan. Gaps from tabletop closed. | Day 60 — Audit dry run + Board Update 2 (13 Dec). Three Board resolutions sought. |
| 10 | 17-23 Dec | C — Pressure-test | Dry-run findings remediated. Parallel-run: DPO 12-month calendar drafting starts Day 60 (Row 12). Vendor DPAs: all 10 signed or kill-switched. | — |
| 11 | 24-30 Dec | D — Install | Audit evidence file assembly. DPO calendar review with Nandini. Board deck template handover. Low-traffic week — plan accordingly. | — |
| 12 | 31 Dec-6 Jan | D — Install | KPI dashboard wiring. DPO walk-through rehearsal (dry run of the handover). DPO calendar finalised Day 85. | — |
| 13 | 7-12 Jan | D — Install | Handover meeting. Audit evidence file index approved. Final payment milestone. Phase-2 offer presented. | Day 90 — Handover (12 Jan). Nandini runs the sixty-minute walk-through solo. |
The three parallel-run activities (Row 6 vendor DPAs from Day 10, Row 8 breach runbook from Day 20, Row 12 DPO calendar from Day 60) are marked bold above. Together they save about two calendar weeks across the engagement.
Your artifact from Lesson 4
Open the Gantt template in the resource panel. Mark the four checkpoint dates for a hypothetical start date of 15 October (or adapt the sample above). Lay in the three parallel-run activities. Share with a peer and ask one question: at any point in the 90 days, can you point at the current week and name the active phase, the next checkpoint, and the two deliverables due inside the current week? If yes, your Gantt is ready. If no, you have gaps to close.