⛉Data protection in everyday work

Yes, and it has three parts:

1. Only what you need. Do not collect anything that is not necessary for the task. A form with ten required fields, of which you use two, is already a problem.

2. Only who needs it. Not everyone in the team has to see everything. A CC to five people is a disclosure to five people.

3. Only as long as you need it. Whatever has served its purpose should be deleted — not archived just in case.

The practical test before every action: Could I explain why I am storing this, whom I am showing it to and how long I am keeping it? If you falter at any of the three, that is the point at which you should stop and think briefly.

This does not replace a legal review — but it prevents most cases before they arise.

Factual information about the working relationship — and nothing you would not read out to the person.

Behind this is not politeness but practice: in response to a subject access request, a note may have to be handed over. Whatever you write, the person concerned can read.

Fine:

• “Prefers to be called in the morning.”
• “Does not decide alone, purchasing has to agree.”
• “No interest in topic X, but in Y.”

Not fine:

• Value judgements about the person or how they come across.
• Details of health, ethnic origin, religion, political opinion.
• Assumptions about private circumstances.
• Irony. It does not survive being taken out of context.

And the side effect: factual notes are useful to colleagues as well. A note in which someone has let off steam helps nobody — not even the person who wrote it.

Only those who actually need the matter, and for everyone else: not at all.

The three mistakes that keep happening:

1. CC instead of BCC with several recipients. Everyone then sees everyone else’s address. With private addresses, that is a reportable breach, and it happens regularly.
2. A distribution list that has grown over the years. At some point it includes someone who has long since stopped being responsible.
3. CC to the line manager as a means of pressure. That is not a data protection question in the narrow sense, but it spreads data without reason.

What you ask yourself before every CC: what will this person do with the information? If the answer is “read along”, that is not a reason.

And with several external recipients: BCC, or better: individual emails. Campaign sending does this correctly by itself.

By a single question: has personal data reached someone who should not have received it — or has it been lost?

Typical cases:

• An email to the wrong recipient.
• An open CC with other people’s addresses.
• A document with someone else’s data as an attachment.
• A report containing data of another customer.
• A lost device without encryption.
• An account used by someone unauthorised.
• Data deleted by mistake without a backup.

What many people do not know: the loss of data counts too, not just unauthorised access.

What matters now is speed. The deadline for notifying the supervisory authority is short — it starts as soon as you become aware of it. Report it internally straight away, even if you do not yet know how serious it is.

And the mistake that makes it worse: waiting and hoping.

Five steps, in this order, and the first is not “think about it”:

1. Stop it spreading further. Halt the sending, withdraw the share, lock the account.
2. Report internally — to the person responsible for this in your organisation. Immediately, not after lunch.
3. Record what happened. What, when, how many people affected, which data. In writing, while you still remember.
4. Have it assessed whether it has to be notified — to the supervisory authority and, where applicable, to those affected.
5. Remove the cause, not just clean up the individual case.

We advise against:

• Quietly cleaning up the incident and saying nothing.
• Removing traces before anyone could look at them.
• Reassuring those affected with statements you cannot back up.

And what nobody will hold against you: a report that turns out to be harmless.

When the purpose has been fulfilled and no retention obligation stands in the way.

The two directions that can contradict each other:

• Data protection says: delete as soon as it is no longer needed.
• Commercial and tax law says: keep it, for several years.

How to resolve this: not everything is a business record. An invoice must be retained; a note about a phone call need not. Separate the two — then you can delete the one and keep the other.

What to do in practice:

• A list of which type of data stays for how long.
• A date on which you apply it. Quarterly is enough.
• No deleting “by gut feeling” in the middle of an ongoing case.

And the case in which you must not delete: when legal proceedings are under way or threatened.

The individual periods are a question for your legal or tax adviser.

That is a subject access request, and it has a deadline. Take it seriously, even if it is phrased casually.

What you do straight away:

1. Record the date. The deadline runs from receipt, usually one month.
2. Pass it on to the person responsible, instead of answering yourself.
3. Delete nothing that has been asked about.

Point 3 is where businesses make mistakes: the reflex to tidy up quickly is understandable and wrong. Deleting after a request looks bad and can be a breach in its own right.

What you should not do: answer off the cuff. A subject access response is either complete or wrong — there is little in between.

And the preparation that makes everything easier: write down once where data is held at all. Then a subject access response is an hour’s work instead of a day’s.

The unspectacular things — that is where most things happen.

Screen:

• Lock it when you get up. Even for five minutes.
• Do not position it so that visitors can read along.
• When sharing your screen in video calls: share only the window, not the whole screen. Otherwise notifications pop up in the middle.

Paper:

• Do not leave anything lying around that contains names.
• Collect printouts from the printer immediately — especially on shared devices.
• Shred confidential material; do not put it in the waste-paper bin.

Conversations:

• No names in an open-plan office if it can be avoided.
• Do not discuss things on the phone on the train that are nobody else’s business.

And on the move: a privacy screen for the laptop costs little and prevents people reading along on the train — the most common unnoticed disclosure of all.

The same as in the office, only with more opportunities to get something wrong.

Preparation:

• Encryption switched on. On current devices it usually is — check it once.
• Screen lock with a short timeout.
• Remote wipe set up, so that a lost device does not mean lost data.

On the move:

• No open Wi-Fi for work data without a secure connection.
• No work data on private devices, unless there is a policy for it.
• Do not send anything via a messenger that is not intended for it.

If a device goes missing: that is a reportable incident until proven otherwise. Report it immediately — the question of whether anyone could access it is for someone else to clarify.

And the simplest precaution: store as little locally as possible. What is only in the system is not lost with the device.

Not without agreement — even if it is free and everyone uses it.

Why: as soon as you put data into a third-party service, it processes the data on your behalf. That usually requires a contract, and it has to be checked where the data is stored.

The typical cases:

• A translation service into which a contract is copied.
• A file conversion service.
• An AI tool into which a job application is pasted.
• A private storage service, to “quickly share something”.

All four are the same problem, and all four happen every day.

How to do it: ask before you use it. If there is an approved tool for the purpose, use that. If not, say so — perhaps one is missing.

And the special case: anonymised content without any personal reference is less critical. But “anonymised” really does mean anonymised, not “name removed”.

Whatever may be processed in an approved tool, and as little as possible there.

What is regulated within the programs: the AI functions run via an access for which the processing is regulated. You can use them within the intended scope.

What is not regulated: an AI tool that you open yourself in the browser. The same applies there as for any third-party service.

What you should bear in mind in both cases:

• Remove names and contact details if they are not needed for the task. To improve a text, the AI does not need a real name.
• No special category data. Health, ethnic origin, trade union membership do not belong in it.
• No complete application documents in a tool that is not intended for that.

And the result remains your responsibility. What the AI writes, you answer for — not the AI.

Only with consent — and it has to match the purpose of use.

What this means:

• Consent to a team photo on the website does not cover use in an advertisement.
• Consent from five years ago does not automatically apply to a new page.
• Consent can be withdrawn — then the image has to go.

What you should record: who consented, when and to what. A photo without this proof is a risk you cannot see.

At events: a notice at the entrance is often not enough for everything. Individual shots need more than a general crowd shot.

With employees: consent within an employment relationship needs particular scrutiny, because whether it is voluntary can be questionable. And when someone leaves, the question arises again.

The practical advice: keep a list of the photos of people in use, with where they appear. When consent is withdrawn, you will then find them.

Four things, and nothing more is needed on the first day:

1. Where it says what applies. The internal policy, if there is one, and whom to ask if not.
2. What a breach is and to whom it is reported. With a name, not a job title.
3. Which tools are approved — and that nothing else is used for work data.
4. The standard for notes. The sentence “whatever you write, the person can read” is enough to start with.

And one more thing:

• Limit accounts to what is needed. Do not unlock everything and take it back later.
• Ask again after four weeks. By then the real questions are there.

And what makes the biggest difference: how the team sets an example. Nobody learns rules that nobody follows.

A short list that is worked through on the last day — not weeks later.

Immediately:

• Lock accounts, in all programs.
• End mailbox access or redirect it.
• Collect devices.
• Collect keys and cards.

Soon after:

• Transfer responsibilities — contacts, cases, tasks.
• Sort out personal mailboxes: who answers whatever still comes in?
• Remove photo and name from the website and signatures.
• Inform external parties if they were in contact with the person.

What is often forgotten:

• A shared password the person knew. It needs changing.
• The account with a service provider that only they used.
• Automatic forwarding rules that had been set up.

And legally: an account that still works after someone has left is a finding nobody wants to have to explain.

In most cases yes — the exemptions for small businesses are narrower than they sound.

Why the exemption usually does not apply: among other things, it does not apply if the processing is more than occasional. Anyone who regularly maintains customer data or processes employee data is generally covered.

What goes into it, roughly:

• Who the controller is.
• Which processing activities there are and what for.
• Which types of data and which groups of people.
• Who receives the data.
• Deletion periods.
• Technical and organisational measures.

What it means in practice: a manageable business often gets by with a few pages. The effort lies in creating it the first time; after that it is upkeep.

And the side effect that makes it worthwhile: afterwards you yourself know everywhere data is held. That helps with subject access requests, with deletion and in an emergency.

Expert support is worthwhile for creating it.

Enlarge

Ten, and none of them is exotic:

1. Open CC with several external recipients.
2. Email to the wrong recipient because of address autocomplete.
3. Wrong attachment.
4. Data in a service that has not been approved.
5. Keeping everything, without a deletion concept.
6. Too many accounts, because it was easier.
7. Shared passwords, because a second account seemed too expensive.
8. Notes containing value judgements.
9. An account that keeps running after someone has left.
10. An incident that is not reported, because it is thought to be harmless.

What stands out: nine out of ten are about convenience, not ignorance.

And what helps most: a culture in which a mistake can be reported without getting into trouble for it. Where reports are punished, there are no reports — only undiscovered incidents.