The ungoverned store.
WHY THEY MATTER
They hold enormous amounts of personal data outside any system.
HOW THEY ARISE
Exports for analysis Lists for a campaign Records kept by one person for convenience Reports circulated by email
WHY THEY ARE HIGH RISK
No access control No retention No logging Copies proliferate They are emailed freely
WHAT TO ESTABLISH
Where they exist.
HOW
Ask, and search shared storage.
WHAT TO DO WITH WHAT YOU FIND
Delete what has no purpose Move what is needed into a proper system
WHAT TO DO ABOUT RECURRING EXPORTS
Establish why the system does not meet the need.
WHY
The spreadsheet is usually a workaround.
WHAT TO PROVIDE INSTEAD
The report or view people actually need.
WHAT TO RESTRICT
Who can export personal data at all.
WHAT TO LOG
Exports.
WHY
It is the commonest route by which data leaves.
WHAT TO TRAIN ON
Not emailing personal data Not keeping local copies
WHAT TO SET
Retention on shared storage.
WHAT TO AUDIT
Periodically, for accumulation.
