Lesson 2: Answering Viktor's questionnaire without overpromising

Module 7 · Lesson 2 · About 50 minutes · Needs: Lesson 1 of this module (threat model, encryption, audit log) and Module 4 Lesson 3 (UK GDPR basics, transfers, the contract's data terms)

The situation

Wednesday 1 April 2026, week 3. On Monday you asked for single sign-on and network access, planned for Thursday. Viktor Hale's reply is a spreadsheet of 140 questions: "Access is reviewed once this is complete." Nobody asked him before the contract was signed on 27 February.

Ben Castell messages within the hour: "Just say yes to everything, we need this by Friday." This lesson follows one question, Q-063, "Is Harbourline data encrypted end to end?", to Viktor's desk. Access comes on Friday 17 April, two weeks late. This is not legal advice: legal facts are quoted from regulators' pages, dated.