2 min read317 words
Assess data protection exposure by answering four questions: what personal data you actually hold, why you hold it and for how long, who has access and how that access is controlled, and what your plan is if something goes wrong. Most businesses collect more personal data than they consciously track, and exposure builds quietly wherever these questions haven't been asked.
Question 1: What data do you actually collect?
Most businesses collect more personal data than they consciously track — customer details, employee records, vendor information, marketing data. The first step in any data protection assessment is a straightforward inventory: what personal data does the business hold, and where does it come from.
Question 2: Why is it held, and for how long?
Data collected for one purpose often lingers well past its useful life, accumulating as unmanaged risk rather than a managed asset. Data retention without a clear rationale is a direct example of unaddressed exposure in practice.
Question 3: Who has access, and how is it protected?
Access that isn't deliberately restricted tends to expand quietly over time, as more people and systems touch the same data without a corresponding increase in oversight.
Question 4: What happens if something goes wrong?
A business without a considered response to a data incident is making that decision reactively, under pressure. This is precisely the pattern to avoid: legal issues addressed only after something has gone wrong, rather than anticipated and planned for.
Frequently asked questions
- What's the first step in assessing data protection exposure?
- Taking an inventory of exactly what personal data your business holds and where it comes from.
- Do businesses need a dedicated compliance department for data protection?
- No. A deliberate, periodic legal review can apply the same rigor without requiring a full-time hire.
- What's the biggest overlooked data protection risk?
- Data retained without a clear rationale, and access that has expanded over time without corresponding oversight.
Talk to Gallant before you make the decision
Not only after something goes wrong. If this raises a question specific to your business, we're glad to talk it through.
This article is general legal information, not legal advice, and does not create a lawyer–client relationship.