Personal data collection, purpose, access, sharing, retention, security, and deletion checklist

What to take away

Complete the checklist for one product, process, or data set at a time.
Answer with evidence, an owner, and a review date, not a bare yes.
Test actual flows against notices, settings, contracts, and retention schedules.
Treat vendors, logs, exports, backups, and test systems as part of the lifecycle.
Record exceptions and corrective work instead of forcing a false pass.

This checklist is a review tool, not a legal certification. Applicable duties vary by jurisdiction, organization, role, data, and use. Mark each item Pass, Partial, Fail, Not applicable, or Unknown. For every answer, name the evidence and responsible owner.

Scope and purpose

The product, process, population, systems, and review date are defined.
Each processing purpose is specific and understandable.
The data needed for each purpose is identified.
Optional purposes are separated from required service functions.
New uses trigger a documented compatibility and legal review.
High-impact decisions and vulnerable populations receive added review.

Collection

Every field has a source, purpose, and necessity decision.
Required and optional fields are labeled correctly.
Sensors, software kits, cookies, logs, and inferred records are included.
Collection from other companies or public records is documented.
Test and support channels do not collect unplanned sensitive information.
Unused fields and duplicate copies have been removed.

The FTC's business guide on protecting personal information tells organizations to take stock, keep only what they need, protect retained information, dispose of unneeded records, and plan for incidents. That supports the lifecycle prompts here. It does not certify any specific organization or replace applicable law.

Collection Field Audit

Every field has source, purpose, necessity decision
Required and optional fields labeled correctly
Include sensors, software kits, cookies, logs, inferred records
Document collection from other companies or public records
Test and support channels avoid unplanned sensitive data
Remove unused fields and duplicate copies

Notice and choice

The notice appears when it can inform the decision.
Language matches actual collection, use, recipients, and retention.
Choices are not preselected or misleading where real consent is required.
Refusal and withdrawal consequences are stated accurately.
Notice versions and collection dates can be reconstructed.
Product menus do not promise more than back-end systems perform.

Access and internal use

Roles receive only the access their tasks require.
Privileged access is approved, logged, and reviewed.
Departed workers and stale service accounts lose access promptly.
Production data in development and testing is eliminated or controlled.
Bulk exports and support downloads have separate safeguards.
Unusual access can be detected and investigated.

Sharing and service providers

Every recipient category and transmitted field is known.
Provider instructions, independent uses, and onward transfers are distinguished.
Contracts, configurations, and observed transfers agree.
Subprocessors and material changes trigger review.
Service termination includes return or deletion duties.
Cross-border and government-access questions are assigned for legal review.

Retention

Each record class has a trigger, period, reason, owner, and disposal action.
Live records, logs, archives, backups, paper, and vendor copies are covered.
Legal holds suspend disposal only for the necessary scope.
Expired records are erased, anonymized, or placed beyond use as designed.
Exceptions are approved, dated, and reviewed.
Retention jobs are monitored for failures.

Security and resilience

Controls follow sensitivity, harm, volume, exposure, and threat.
Authentication and recovery resist foreseeable abuse.
Encryption and key management cover relevant storage and transmission paths.
Systems, libraries, and devices receive managed updates.
Backups are protected and recovery is tested.
Vulnerability reporting and incident escalation routes work.

NIST's Privacy Framework FAQ distinguishes privacy-risk functions from the cybersecurity functions that can support security-event detection, response, and recovery. That supports checking privacy purpose and security protection separately. It does not prescribe one control set for every service.

Individual access and control

Available access, correction, download, objection, restriction, and deletion paths are listed.
Identity checks are proportionate to the request and risk.
Requests reach every relevant system and provider.
Denials, exceptions, and partial results are explained and recorded.
Appeal or complaint routes are provided where applicable.
Request records have their own limited retention schedule.

Deletion and disposal

Account closure is distinguished from record deletion.
Deleted content disappears from search, sharing, and active interfaces as promised.
Cached, replicated, backup, and vendor copies follow documented schedules.
Paper, removable media, and retired devices are disposed of safely.
Pseudonymization is not mislabeled as deletion or anonymization.
A sample deletion can be traced to completion.

Incidents and complaints

Reports can be received from people, staff, vendors, and researchers.
Triage covers both security events and harmful authorized processing.
Evidence is preserved without needless new collection.
Notification decisions have named legal and operational owners.
Corrective action reaches systems, notices, contracts, and training.
Repeat issues are tracked across products and vendors.

Close the review

Summarize unknowns, failures, owners, due dates, dependencies, and accepted residual risks. Preserve the evidence snapshot. Set the next review based on product change, vendor change, incident, complaint, legal development, or a defined calendar date.