Map the information collected
List the information collected at each step: anonymous product selections, submitted contact details, saved designs and site photographs. Record the purpose, storage location and recipients for each category. A postcode may be enough to check initial territory fit, while a full address may be needed later for a survey. Keep the requested information aligned with the task being performed.
Define responsibilities and controls
Define who needs access to inquiry details, prices and site uploads, then test those permissions with sample accounts. Document the providers receiving personal data and the owner of retention and deletion procedures. Use a sample closed project to check where copies remain, including forms, email, shared documents and any connected system. Give each category a retention decision based on its purpose.
Use the current UK guidance
Use the Information Commissioner's Office guidance on documenting processing and storage limitation when reviewing the data map. The review should connect the purpose of collection to recipients, security measures and retention. ICO guidance explains that there is no single UK GDPR retention period for every record; decide what is needed for each purpose and implement the resulting review or deletion process.
Implementation checklist
- Actual data map
- Access and retention owners
- Provider responsibilities
- Operational checks