Privacy and data protection

Not legal advice. Regimes differ by jurisdiction and change; material questions need qualified counsel. This structures the assessment and identifies what to escalate.

Start from the data map

You cannot assess what you have not inventoried. For each category of personal data:

• What is collected, from whom, and where it came from.
• Why — the specific purpose, and the lawful basis where one is required.
• Where it lives, who can reach it, and which vendors receive it.
• How long it is kept, and what deletes it. "Indefinitely" is a finding, not an answer.
• Whether it crosses a border, and under what mechanism.

Most privacy failures are inventory failures: data nobody remembered was being collected, in a system nobody owned.

Design decisions that prevent problems