Data Collection · Consent and basis · Component
The notice
What people were told, and whether practice still matches it — because the notice is a commitment regardless of who reads it.
The deliverable
What it is
The privacy notice is a commitment. Practice that has drifted from it is a breach whether or not anyone read the notice, and drift is the normal state after a few years of product change.
Checking practice against the notice is a half-day exercise that finds something almost every time.
One level in
What it is made of
Each element is a constituent part of the component. Follow one to see the attributes it carries.
The statement
What the notice says about this data.
3 attributes: What it says · Version · In force from
LearnThe practice check
Whether what happens matches what was said.
3 attributes: Matches · Divergence · Checked
LearnThe requests
What happens when someone asks about their data.
3 attributes: Request type · Time to fulfil · Can be fulfilled
Learn
The test of a deletion policy is whether all copies of one person’s data can actually be found.
The other components in consent and basis
The basis
What entitles the organisation to hold each data set — recorded per set, because each basis has different consequences.
LearnThe purpose
What it was collected for, which constrains what it may be used for — because the useful new analysis is frequently the one that would breach it.
Learn