Privacy programme implementation that holds up — governance, workflows, AI oversight, vendor controls and a three-team operating model that turns policy into defensible practice.