Privacy Compliance: Collect Less and Explain More

Map data and purposes

List what personal data is collected, where it comes from, which systems receive it, who can access it and how long it is retained. Tie each field to a specific purpose rather than collecting information because a form can ask for it.

Use appropriate notice and choice

Explain data use in clear language and provide the controls required for the relevant jurisdiction and technology. Do not treat a privacy notice as a replacement for consent where consent is required.

Limit access and retention

Grant access by role, remove it when no longer needed and set retention or deletion rules. Review vendors, exports, backups and integrations that may create copies of personal data.

Test marketing technology behaviour

Check consent signals, tags, pixels, forms, unsubscribe flows and data transfers. Confirm that tracking follows the chosen consent state and that sensitive identifiers are not placed in URLs or analytics events.

Keep accountability visible

Assign a privacy owner, document decisions, train staff and maintain a process for data requests or incidents. A compliance checklist is useful only if someone keeps it current.

Common mistakes to avoid

• Choosing tactics before defining the customer need and desired outcome.
• Relying on surface metrics without checking downstream quality.
• Making changes without clear ownership and review criteria.