Compliance work in data projects is often left to the end, and by then changing the architecture is expensive. Yet when data inventory, retention and access decisions are made at design time, the added cost is close to zero.
Decisions to settle at design time
- Which personal data is processed, on what legal basis
- How long data is retained and how it is deleted
- Who can access which data, and why
- At which points data can be anonymised
- Whether cross-border transfer is involved
Once these answers are documented, an audit becomes an archival exercise rather than a rebuild.