Loading page…
The foundations privacy compliance depends on. Most privacy programmes stall because these were assumed rather than established.
Data protection leads, CDOs, compliance managers and IT leaders preparing a data governance or privacy programme.
Work top to bottom — the sections are ordered as dependencies, not preferences. Answering the privacy section before the inventory section is the single most common sequencing error, and it produces a register of processing activities that cannot be verified.
Privacy obligations vary by jurisdiction and by the role you occupy for each dataset. This checklist establishes the foundations those obligations rest on; it does not determine which law applies to you or what it requires in your circumstances.
Every subsequent section depends on someone being accountable for each dataset. Where ownership is unresolved, the rest of the programme has nowhere to land.
Domains drawn along business lines — customer, employee, financial, operational — each with a named owner who has accepted accountability, not a system administrator by default.
Owners set direction; stewards handle the operational questions. Where a single person holds both roles across many domains, the model will not scale past the first competing priority.
Data questions cross functional boundaries by nature. Without a forum with authority to decide, disputes escalate to whoever cares most rather than whoever is accountable.
Who can approve a new use of a dataset, authorise sharing with a third party, or agree a retention change — recorded rather than assumed.
You cannot govern, classify, protect or lawfully process what you have not inventoried. This is the section most often skipped and most often the root cause of later failure.
What data exists, in which system, owned by whom. Complete for systems of record before it is complete everywhere — partial and accurate beats comprehensive and stale.
Which datasets contain personal data, which contain sensitive categories, and for each, the purpose it is processed for.
Where data moves between systems, to third parties, or across jurisdictions. Cross-border transfer is a compliance question that cannot be answered without this.
Extracts, reports, analytics environments, test datasets and local spreadsheets. Governance applied only to systems of record misses where most uncontrolled copies live.
For the elements that matter most, where they originate and what transforms them. Full lineage everywhere is rarely achievable; lineage for critical elements usually is.
Classification is only useful if it is applied correctly by people who are not thinking about it. Complexity here reliably produces misclassification.
Three or four tiers with criteria a non-specialist can apply consistently. Schemes with more tiers than most people can name are misapplied more often than not.
Storage, transmission, sharing, retention and disposal rules defined per tier, so classification changes behaviour rather than adding a label.
Every inventoried dataset has a classification. An unclassified dataset defaults to the most restrictive handling, and that default is stated.
A dataset's classification can change with use. A trigger exists to review it when a new use is approved.
Governance without quality measures is administration. Retention without disposal is accumulation.
Completeness, accuracy, timeliness, consistency and validity — defined with a measure and a target for the elements that matter, not aspirationally for all data.
Measurement running on a cadence with results visible to the data owner, so quality is a managed property rather than an occasional discovery.
Derived from legal, regulatory and business requirements, with the basis recorded. 'Indefinitely' is a decision that needs a justification.
A retention schedule that is never executed increases exposure rather than reducing it. Disposal should produce a record.
These obligations rest on everything above. Attempting them first produces documentation that cannot be substantiated when tested.
Whether you determine the purpose and means of processing, or act on another party's instructions, for each dataset. Obligations and contractual terms follow from this and it is frequently assumed rather than analysed.
Purposes, categories, recipients, transfers and retention — built from the inventory rather than compiled independently, so the two cannot disagree.
Recorded per processing purpose, not per system. Where consent is relied on, the mechanism for capturing, evidencing and withdrawing it exists and works.
Privacy notices drafted from the processing record. Notices written independently of the inventory routinely describe processing that does not happen and omit processing that does.
Access, correction, erasure and portability requests can be executed across all systems holding the data within the required timeframe — tested, not assumed.
Clear criteria for when a processing activity requires an assessment before it begins, and a template that people actually use.
How a personal data breach is detected, who assesses severity against the notification threshold, within what timeframe, and to whom.
Next step
Send us what the assessment surfaced and we will give you a view on which items are genuine blockers, which matter less than they look, and what closing them realistically takes.