The Money Files

Last month I looked at some of the basics for data privacy on projects. Let’s go into that in a bit more depth this month, by looking at some of the project tasks you can schedule to help manage data on your project within the regulations of your country, whatever they are.

1. Data mapping

The first activity you can schedule is data mapping. You might already have a customer journey or user flows or process maps. Can you add a swimlane for data on that? Or if necessary, create a new data map.

The data mapping exercise should help you understand where, how, and why data is being collected throughout the project lifecycle and beyond.

2. Data Processing Agreements (DPAs)

Another task is creating DPAs with the relevant parties for your project. This is normally something you’d do as you contract with a third party, so lean into the legal or procurement team for support.

A DPA is a document that outlines how data will be handled, stored, and protected. There is probably a template within your organisation already.

Alternatively, the task is to check that DPAs are already in place, if the vendor is one that you use regularly. I like the kind of tasks that can easily be checked off! They help the team feel they are making progress and ensure that you are putting compliance at the forefront of your processes.

3. Due diligence

Schedule time to conduct due diligence on third-party tools and vendors to ensure their privacy and security measures meet your organisation’s data protection requirements. You probably won’t be doing the actual due diligence, so talk to your procurement or legal teams, or the data protection officer to find out how this will happen.

Again, if your company already has a relationship with the third-party, the task here is to check that it was done at some point and does not need to be done again.

4. Data security and risk mitigation

Make sure there are activities on the schedule that involve implementing strong security measures to protect project data. That could include setting up multi-factor authentication, data encryption, and secure access protocols.

Generally, the IT team would have to take responsibility for doing these things or checking that they are already in place from a third party. Talk to them about the kinds of tasks that need to go on the schedule so they have enough time to put security measures live before the project launches.

5. Testing

Make time for data testing. For example, schedule penetration testing. Look through your risk register for risks related to data breaches or leaks and have mitigation strategies in place that you can test out. That might be checking you can restore from back up or testing security protocols for data access.

Again, talk to your technical teams about what this might look like for your projects and put the time in for this work so it doesn’t get squeezed in at the last minute or forgotten about.

All of these scheduleable (is that a word?) tasks will help you address any risks or issues relating to non-compliance and show that you are actively prioritising data privacy. Next time I’m going to look at training teams on data privacy best practices. Meanwhile, why not share your experiences of data on your projects in the comments below? Thanks!

I don’t know about your projects, but the role of data privacy and information governance has certainly expanded since I started managing projects.

Data privacy has become a critical concern for organisations globally, and you only have to look at high-profile cases in the media about ransomware attacks, data leaks and breaches to realise that we’re all only one potential hack away from a major problem. Is that on your risk register? It could be.

Projects use or create a lot of sensitive data, depending on what industry you are in. Even if you aren’t dealing with medical records, your project probably includes some confidential company information for you or your clients. Even operational data could be sensitive if a competitor got it.

Therefore, project management processes have to take into account data privacy standards. Meeting those are the basics. You have to maintain trust in your organisation and avoid exposing the business to significant legal and financial consequences. Non-compliance can result in fines and reputational damage, and there are plenty of cases in the UK, for example, where GDPR breaches have been heavily fined.

In this article, we will discuss the key data privacy regulations that impact project management, how to assess your project management tools for compliance, and steps you can take to ensure your team handles project data securely.

Data privacy regulations

I know that readers come from all around the world, and privacy laws differ, so I’m not going to try to list all the relevant global legislation. Suffice to say that in the UK where I am based, GDPR is a key regulation. Where you are will no doubt have similar regulations on how personal data is collected, processed, and stored.

The laws that I am aware of generally all have similar aims: to ensure data is collected for the right reasons, stored securely and disposed of appropriately, and that data subjects know what is being done with their personal information.

Key principles of data privacy

Projects should take into account how data privacy is going to affect the work of the project and deliverables. Generally (although I’m not a legal expert in your country’s regulations, so take advice from your information governance team), what you are looking for are the following.

Data minimisation

Collect only the data necessary for the project’s purpose. Don’t collect extra things because they would be nice to have or would help a future project. Work out what data is required for the purpose of this project, and that’s all you can have.

Purpose limitation

This principle says that you have to ensure that data is used only for the purpose for which it was collected. In other words, if your project is collecting data for the purpose of processing a customer order, you can’t then use it for something else.

Consent management

People need to know what they are consenting to and what you are going to do with their data. this is all about transparency. If your project is collecting data from people that you didn’t have before, obtain explicit consent for that. Mostly this will be covered off by any privacy notice you have on the site, or in your terms and conditions – so you must make sure your project links in with any existing consent management systems (or builds a new one if needed)

Data security

Not surprising – if you need to build measures to protect data from unauthorised access, breaches, and leaks, do that, or tap into what already exists. This goes for user access too, so make sure only the right people in your company have access to data.

Transparency and accountability

Keep clear records of data handling practices and be transparent with customers about how their data is used. You may find this is already covered in existing terms and conditions or privacy notices, but always take advice from your legal or information governance team, or data protection officer to make sure your project isn’t introducing anything that would diminish existing processes or require new ones.

I’m continuing my deep dive into continuous improvement this month as it’s such an important topic for project managers. There’s this expectation that we will use the retro and lessons learned processes to make improvements, and yet there is rarely the time to fully implement lessons. That’s one of the major challenges, and I want to talk more about challenges in making changes to ways of working today.

Resistance to change

The first challenge is resistance to change. Resistance can come about for lots of reasons, not least because people are worried about the extra workload of having to deliver project management process changes on top of their project execution activity.

Also, humans seem programmed to not like change. Having to learn a new way of working is a pain.

We can address this in the same way as you address change resistance to any of your projects: understanding the concern, clear communication, training and support and demonstrating the benefits. Plus a bit of management ‘this is the new way of working and you will follow the process’ can be useful!

Sustaining momentum

Improvement programmes might start out well, but it’s challenging to keep them going. After all, there are only so many improvements that are simple to make and easy to implement, so you might feel your goal of improving continuously is struggling because people have already suggested the easy wins.

Team members might not engage with it any longer. Keep celebrating success, keep recognising good contributors (without making those who cannot suggest improvements for whatever reason feel bad).

Pace out your changes so there is a small strand of work happening throughout the year instead of a big push and then nothing.

Resource constraints

I’ve mentioned this a lot throughout the series because I really do think it is the hardest thing to overcome. We have to balance improvement activities with project deliverables.  In resource-constrained environments (isn’t that everyone’s project environment?), you may find it challenging to allocate time and resources for improvement initiatives. Management might not see the value.

People doing the work might prefer to focus on their project work, which probably already has to be balanced against their business as usual activity. Now you’re asking them to do even more, and even if they are willing, they have to make prioritisation calls, and frankly, changing processes is probably way down the list.

They might be incentivised on other things. Their personal performance metrics or team objectives and KPIs probably don’t include the new improvement that has only just been thought up. So unless you’re going to work with line managers to write in a percentage of their availability to work on improvements, expect to see some up and down commitment throughout the year. People will do what they can, but creating the space for them to do that is important.

I’d love to hear your suggestions for helping teams find the time to overcome resource constraints for project improvements? Do you build it into their personal objectives or make it part of the expected ways of working for the squad? Let me know in the comments below!

That concludes my deep dive into continuous improvement. It’s an important aspect of project management practice, and it helps us create an environment where we can contribute to the business in more ways than simply project delivery. We can be the driver for change as project managers, and help our teams, and our organisations, deliver more in difficult times.

Over the last few weeks I’ve looked at why continuous improvement matters in project management, how we create the right culture for it and what tools we’ve got available to do it (lots, fortunately).

Now, I want to look at how you can check to see if those improvement opportunities are having the effect you expected. Again, we have project management tools and techniques readily available for this because we have methods for benefits realisation and tracking. And those are the kind of things you can draw on for tracking.

But first, we have to start off with some metrics.

What metrics are you going to use?

All benefits tracking relies on having something to track against, so when you are planning your improvement initiatives, it’s important to think about what you are going to use to track. How will you know if the change has been successful?

In reality, some of the changes are going to be small and you wouldn’t track them. For example, I removed a section of a template that was no longer relevant – I’m not going to set up tracking to establish whether or not that was worth it. It was worth it. If in the future we decide we want it back in (we won’t), we can add it back in.

But there are other changes where it is worth measuring the impact, especially if you have to justify the change in some way. For example, if you need investment to make the change (like a change to your software tool or to pull chargeable resource off a chargeable project to do an internal change) then you’ll want to track.

You could look for:

Process efficiency metrics: Track changes in key process metrics, such as time to completion, resource usage, and cost savings. Ideally, you would want to see a reduction in time or cost per task. So you have to have ways to track that today, and not be implementing anything else at the same time that would also affect the metric.

Quality improvements: Measure the improvement in project deliverables, such as defect rates or rework levels. You’re looking for a decrease in errors or bugs. For example, if you’ve implemented improvements to software testing or pair programming.

Team engagement: If you have employee satisfaction surveys you could use those results. Or you could look at team retention rates, or the number of improvement suggestions submitted by team members as an indicator of engagement with the continuous improvement process. However, a lot of factors influence engagement, so it’s hard to say with confidence that it’s the changes that have been made that have had a significant (or any) impact on engagement and morale. Also, the impact diminishes over time. While people might start out thinking the change is amazing, over time it just becomes ‘the way we do things around here’ and people start to take it for granted.

Assessing the impact

You’ll need to find a way to track performance before and after. Alternatively, consider benchmarking against other organisations. I’d only suggest doing this if you already have access to the information. When we’ve run a benchmarking exercise, it’s been expensive and I’m not sure it gave us the level of detail that would help with project management continuous improvement. So I personally wouldn’t be recommending that we invest in benchmarking unless it was for something bigger, like an assessment of PMO maturity against industry competitors.

Anyway, I digress.

Qualitative measures

It’s also OK to go for qualitative measures like stakeholder feedback. Ask if they think your improvements have made a difference.

However, it also might be positive if they haven’t noticed a difference. That means your change has gone in so smoothly that it is transparent to stakeholders, and that might be a good thing!

Be sure to ask the team as well. Continuous feedback loops are useful, and basically that just means talking to people about how the change has impacted them and listening to their feedback.

I’m enjoying writing about continuous improvement, and next time I’m going to cover some of the challenges that you might face while trying to make project management process improvements, with perhaps a few tips on how to overcome those. See you then!

I’ve been looking at continuous improvement in project management this month, covering why it matters and ideas for building a culture where continuous improvement is the norm. Now I’m going to turn to look at what you have available to help, in terms of tools and techniques.

Luckily for us in project management, we have a range of tools available already that you are using across the rest of your project delivery work, and we can put those to use.

Tools for collecting feedback

First off, you have to make sure that you can collect the improvement ideas. We talked a bit about that in my last article (suggestion boxes) and there’s a lot more you can do – with techniques you will already be familiar with.

Surveys and questionnaires

We use Microsoft Forms for sending out lessons learned surveys and you could set up a form (on any platform) to gather feedback at various points in the project or simply have one on your team intranet page for people to suggest improvements when they think of them.

The trouble with ‘fill it in when you want’ forms is that you have to keep constantly reminding people it is there, so when they do have an idea they go to the form instinctively.

Retros

You’re probably (hopefully) already using retrospectives and lessons learned. Add in questions, if you don’t already have them, for the group to reflect on how project management processes could be changed to deliver better results.

Team meetings

Add an agenda point to your regular team meetings where you talk about what’s been improved, what improvements are being worked on and ask for suggestions. It doesn’t have to be every week, but once a quarter or something like that would work well as a reminder for the team.

Techniques for learning

Once you’ve got some ideas, you’ll want to dig into them and see if they stand up to scrutiny – and whether they are worth the effort to change. Luckily, again as project professionals, we have a range of techniques already in our toolboxes that help us do exactly that.

Root cause analysis

Use root cause analysis techniques (like the ‘5 Whys’) to identify the underlying causes of issues. Then you can focus in on what is genuinely going to address the problem.

Lessons learned databases

You’ve got a repository of lessons learned from each project, right? Take a look through that at the types of projects that have struggled in this area and what has already been done to resolve the problem. That should help prevent you from wasting time on solutions that have already been shown not to work.

Peer reviews and feedback

You’ve got experienced people on the team. They’ve come from different corporate backgrounds and industries, so make use of their knowledge and find out what has worked in their previous roles.

Project management tools

Don’t forget that we also have access to project management tools. Collaboration tools can help people communicate and work together to sort out issues. Planning and scheduling can be done for your improvements, using the tools you already have. Use your knowledge management systems to capture, store and share the ideas, improvements and lessons, so that everyone can benefit from any information created.

With all the resources available to us, it should be easy to make improvements to ways of working. So let’s say you’ve made the improvements, and you want to track how things are going and whether your improvements are having the impact you expected. That’s what I’ll be talking about next time.