Map personal data before the feature spec

Privacy risk starts at collection, not at breach response. A data map is small enough for a product manager to do and specific enough for counsel to review. It turns “is this allowed?” into “is this purpose, field, retention period, and user notice defensible?” What to scan Use a short checklist: who is affected, what the user sees, what data or content moves, what promise the company makes, and what evidence you would need if challenged. Common trap Teams often debate risk level before they have facts. A two-minute fact map usually changes the answer.

Sign up free — one personalized lesson every day, matched to your role and goals.

Already have an account? Sign in