Unsolicited personal data.
HOW IT ARRIVES
Customers sending documents you did not request Attachments containing more than needed Free-text fields with sensitive disclosures Copies of identification sent unprompted
WHY IT IS A PROBLEM
You hold data with no basis and no purpose.
WHAT TO DO
Delete it, unless there is a reason to keep it.
WHY PROMPTLY
Every day it exists is exposure.
WHAT TO RECORD
That it was received and deleted, briefly.
WHAT TO DO ABOUT REPEATED OCCURRENCES
Change the process that invites it.
WHAT EXAMPLES LOOK LIKE
A form inviting people to explain their situation, which produces health disclosures A support process where customers send full documents rather than an extract
WHAT TO DO ABOUT FREE-TEXT FIELDS
Recognise they will contain anything, including sensitive data.
WHAT TO APPLY
The same protection as for sensitive data, or remove the field.
WHAT TO TRAIN STAFF ON
Not requesting more than needed What to do with what arrives anyway
WHAT TO AVOID
Keeping it because it might be useful.
WHY
That is not a lawful basis.
WHAT TO CHECK PERIODICALLY
Mailboxes and shared folders, for accumulated documents.
WHAT TO DO
Delete what has no purpose.
