Context
Personal data was spread across systems with no clear record of what existed, where it lived, or why it was kept.
Decisions
- Audited the data lifecycle to map where personal data actually lived.
- Deleted data with no continuing purpose rather than documenting it.
- Put retention rules on what remained, and designed the compliance architecture around them.
- Set up a repeatable process so a data subject request is an afternoon of work instead of a fire drill.
Result
An unclear data inventory and ad hoc responses were replaced with documented data locations, deletion and retention policies, and a defined request process.