’s Data Protection Act is not a banner in the footer. It changes which columns you collect, who can open them, how long you keep them, and what you can hand to a model or a vendor.
Collect the column because the job needs it
A national id, a child’s name, a health note, and a precise location are not defaults on a signup form. Write the purpose next to the field: this phone number is how we send the receipt. If you cannot write the purpose, do not add the column. A form that asks for everything “in case” is a liability you will have to answer for later.
Say who the controller is, in a sentence a customer can read, at the moment you collect the data. If you process for a client, the contract should say you are the processor and what you may do. A handshake does not survive a complaint.
Access is a query, not a shared password
Staff see the rows their job needs. A support agent can see the order. They do not get a copy of the whole customer table in a spreadsheet emailed on Friday. Exports are a permission, they are logged, and they expire. The log is how you answer “who opened this file.”
Vendors are part of the map. The host, the email provider, the SMS gateway, and any model you send text to should be listed, with what you send them. A prompt that includes a customer’s statement is a disclosure. Do not put that statement in a chat tool you would not show the customer.
Keep it only while the reason is alive
A receipt may need to live for a tax period. A marketing list lives until the person says stop, and the stop has to work. Write the retention next to the table: orders seven years, session logs ninety days, failed login attempts thirty days. A job should delete or detach the rest, and you should be able to show that the job ran.
When someone asks for their data or for a correction, you need to find the rows by a key you can defend, and you need a way to do it without breaking the ledger. Anonymise the person on old invoices if you must keep the amounts. Do not invent a delete that removes the tax record.
A form you can explain to a customer
Every sensitive column has a purpose written beside it: this phone number is how the receipt is sent. If you cannot write the purpose, do not add the column. National id, a child's name, a health note, and a precise location are not defaults on a signup form. The controller is named in a sentence at the moment of collection. If you process for a client, the contract says you are the processor and what you may do.
Staff see the rows their job needs. An export is a permission, it is logged, and it expires. A Friday spreadsheet of the whole customer table emailed to a personal inbox is the incident. Vendors are on a page: host, email, SMS, and any model. A prompt that contains a statement is a disclosure. Do not put that statement in a chat tool you would not show the customer.
Retention is a period per table and a job that enforces it. Receipts may live for a tax period. Session logs do not. A deletion that remains in every backup has not been deleted, so the backup lifetime is part of the answer. When someone asks for their data, you find the rows by a key you can defend. You anonymise the person on old invoices if the amounts must stay. You do not delete the tax record to look thorough.
Before the next form ships, read the fields aloud as if the customer were there. Drop the one you cannot justify. That reading is cheaper than the complaint, and it is the practice the Act is pushing you toward anyway.
On the next form you ship
- Write the purpose beside every sensitive column.
- Log exports and keep them off shared mailboxes.
- Put a retention period on each table and run the job that enforces it.
