Knowing what you hold.
WHY IT IS THE FOUNDATION
Every other obligation depends on knowing what data exists, where, and why.
WHAT TO RECORD FOR EACH SET OF DATA
What it is Whose it is Why you hold it Your lawful basis Where it is stored Who has access Who it is shared with How long it is kept How it is secured
WHERE TO START
The systems you know: the customer database, the billing system, email.
WHAT PEOPLE FORGET
Spreadsheets on personal machines Backups Email archives Support tickets Analytics Recruitment records Closed-circuit recordings Messaging conversations
WHY THOSE MATTER
They contain personal data and are rarely governed.
HOW TO FIND THEM
Ask each team what data they handle and where.
WHY ASK RATHER THAN ASSUME
Data collection happens outside any plan.
WHAT TO PRODUCE
A record of processing activities.
WHY THAT NAME MATTERS
It is what regulators typically expect to see.
WHAT TO REVIEW
The inventory, periodically and whenever something changes.
WHAT TO DO WITH WHAT YOU FIND
Delete what has no purpose.
WHY THAT IS THE QUICKEST RISK REDUCTION AVAILABLE
It removes exposure with no ongoing cost.
