A project manager is initiating a predictive project that will process the health records of hospital patients in a jurisdiction that has recently introduced strict data-protection legislation. The team is eager to begin design work. What should the project manager do FIRST?
- ABegin the technical design and schedule a compliance check once a working prototype is available for the team to review.
- BAsk the sponsor to confirm that the compliance requirements documented on the organisation's previous health project still apply to this one.
- CIdentify the specific regulatory and organisational compliance requirements that apply, and build them into the project management plan. Correct
- DEscalate to the legal department and pause all project activity until they deliver a full written interpretation of the legislation.
Why A is wrong: This feels efficient because it keeps the team busy, but deferring compliance until a prototype exists risks building a design that has to be reworked to meet legal requirements identified too late.
Why B is wrong: Reusing prior requirements looks like sensible tailoring, but it assumes the old requirements are complete and current when new legislation may impose obligations the earlier project never faced.
Why C is correct: Identifying the applicable compliance requirements at the outset lets the project manager fold them into scope, quality, and risk planning before design decisions are made, which is the proactive process-following action.
Why D is wrong: Consulting legal is reasonable, but halting the entire project and waiting for an exhaustive interpretation escalates too far and stalls work the project manager could progress while requirements are being clarified.