Collecting privacy requirements for a website
Inventory fields, purposes, access roles and deletion routes, then obtain review of applicable requirements. Copying another website’s notice does not establish compliance.
Putting data and access into practice
Define purpose, scope, access and retention before collection. Public display, internal processing and sensitive information need distinct permissions.
Checking the result
Complete a workflow with minimal data and identify owners for access, correction and deletion. Responsible specialists must separately confirm applicable legal or sector requirements.
