Digital transformation often involves major changes in how data is managed, which places high demands on GDPR compliance. The Chief of Staff (CoS) is responsible for ensuring that data protection is built into all digital projects from the outset (”privacy by design”). This means that the CoS coordinates the work between IT, legal, and business to ensure that personal data is handled correctly and that risks are identified and managed through Data Protection Impact Assessments (DPIA). The CoS should also ensure that all employees receive training in GDPR and that there are clear procedures for incident management and reporting to the IMY (the Integrity Protection Authority). In the Swedish consensus culture, it is important to involve all relevant parties in the process and to create an open dialogue on data protection issues. By working proactively and structurally, the CoS can ensure that digital transformation projects are both innovative and legal.