Data inventory and classification
Systems should record data category, purpose, owner, location, sensitivity, authorised roles, processor, retention and deletion method.
Access and security
Server-side permission checks, MFA for privileged roles, secure sessions, encrypted transport, signed private-file access, authentication logging and regular access review.
Retention and deletion
Proposed defaults include 90 days for abandoned drafts, 24 months for declined applications and contact enquiries, at least 36 months for audit logs, and consent until withdrawal. Final periods require legal approval.
Individual requests
A controlled process will verify identity, locate data, apply legal exceptions, export or correct records and record the response deadline and outcome.
Incidents
Suspected loss, unauthorised access or disclosure requires containment, evidence preservation, risk assessment, escalation, notification analysis, remediation and documented learning.