Nothing confirmed yet. Work down the list and tick what you can genuinely evidence today.

Ticks are not saved and reset when you leave the page. This is a thinking aid, not a record, and nothing here is transmitted anywhere.

0 of 4

Every later obligation depends on this one. You cannot honour an erasure request across systems you have not enumerated.

List every system that stores personal data, including spreadsheets and shared drives.The systems people forget are the ones outside IT's inventory, and those are where nightly exports accumulate.
For each system, record which categories of personal data it holds and why.Purpose is the unit the Act reasons about; a field you cannot justify is a field to delete.
Map where personal data leaves your systems, including to vendors, agencies, and automations.Data you sent to a collections agency or pasted into a model is still your responsibility.
Write down a retention period for each category, and the mechanism that enforces it.A retention policy nothing enforces is a statement of intent, not a control.

0 of 5

The Act requires notice in clear language and consent that is specific, informed, and as easy to withdraw as it was to give.

Review every point of collection for a plain-language notice naming the purpose.A notice that describes purposes in the abstract does not tell the person what will actually happen.
Confirm consent is collected per purpose rather than as a single bundled agreement.Bundled consent cannot be withdrawn for one purpose without withdrawing all of them.
Test withdrawal end to end, and time how long the data actually stops being used.Withdrawal that only updates a flag while downstream jobs keep reading the record is not withdrawal.
Keep a record of what each person consented to, and when, including the notice version.Proving consent later requires knowing which words the person actually saw.
Identify whether you process children's data and what verification you apply.The Act treats children's data as a distinct category with stricter conditions.

0 of 5

Access, correction, and erasure requests have clocks. The common failure is not refusing a request but losing it.

Name the individual who receives data-principal requests, and their backup.A shared inbox with no owner is where statutory clocks quietly expire.
Publish a route for requests that does not sit behind a sales or support queue.A request routed to support is prioritised as a support ticket, not as a legal obligation.
Document how one erasure request propagates to every system in your inventory.This is the step that turns the inventory from paperwork into a working capability.
Record per-source completion for each request, not just an overall 'done'.Demonstrating completion means showing which system confirmed what, and when.
Establish a grievance route and state its response time publicly.The Act requires a grievance mechanism, and an unstated response time is unmeasurable.

0 of 5

Reasonable security safeguards are required, and the standard is judged against what you actually hold.

Review every integration and automation for permissions wider than its function needs.Over-scoped tokens are the most common way a small breach becomes a large one.
Confirm access to personal data is role-based and reviewed on a schedule.Access granted for a project that ended two years ago is still access.
Verify encryption at rest and in transit, and record who controls the keys.Key custody determines who can actually read the data, regardless of where it sits.
Inventory every AI or model call that receives personal data, and what it receives.Prompts are a data flow, and they are frequently absent from data-flow diagrams.
Establish where processing happens, including any model inference.Processing location is a question you will be asked and should not have to research.

0 of 5

The difference between a controlled incident and a crisis is usually whether the trail existed beforehand.

Confirm access to personal data is logged with actor, resource, and outcome.A log that records the query but not who ran it cannot answer the question that matters.
Check whether your logs can be altered or deleted without detection.An audit trail that can be quietly edited is evidence of nothing.
Write the breach notification runbook, and name who decides to notify.Deciding who has authority during an incident is the slowest possible time to decide it.
Rehearse one erasure request and one breach notification end to end.Every process fails the first time it runs; better that be a rehearsal.
Review vendor contracts for processing terms, and know which vendors hold what.Obligations flow to your processors, and you remain answerable for their handling.

Most of it is inventory, not technology

24 things to confirm