Data privacy: what to get right first

Teams tend to reach for this after something has already gone wrong. If you only fix one thing about data privacy this quarter, make it the first item below.

Security is a maintenance habit rather than a purchase, which is why it drifts. Doing this properly once is usually cheaper than doing it approximately three times.

Start here

Collect only what you can justify keeping. The cost of getting this wrong is rarely visible on the day it happens. It is worth deciding this deliberately rather than inheriting whatever the last person set up.

Then this

Deletion policies matter as much as collection ones. None of that requires a large budget, only a decision and someone to own it. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

Eventually

Know where personal data actually lives. Getting it slightly wrong is survivable. Ignoring it entirely is not. It is the sort of thing that looks like polish right up until it costs you an enquiry.

How to tell if yours is fine

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about data privacy before you move on:

• Someone can say what the current setup is without going to look
• Know where personal data actually lives — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If you want a second opinion on how yours is set up, ask.