A CPO has just received a letter from the local data protection authority asking for information about the company’s privacy policy and data deletion practices. Now what? To assist organizations in navigating such requests, this article synthesizes key takeaways from an IAPP Privacy.Security.Risk. 2025 conference panel on which speakers from the California Privacy Protection Agency, RingCentral, Hintze Law and the Future of Privacy Forum took a deep dive into the regulatory investigation process. It discusses how regulators identify potential targets, addressing initial communications, interactions with outside counsel, the meet and confer process, confidentiality concerns, document production and interviews, and the settlement process. See “State Privacy Regulators Share Enforcement Agenda and How to Ensure a Smoother Investigation” (May 14, 2025).