A typical activity to examine
A business application stores user accounts, usage events and support tickets. Some records serve its own operations; others are handled for customers under instructions.
Questions for the responsible team
Use these prompts to describe your own operation. They are examples, not a finding about your organisation.
- Which information is used for your own purposes and which belongs to customer-directed activities?
- Can test environments and support exports contain production personal data?
- Who reviews a new analytics event, integration or subprocessor?
A useful first work package
Map one customer journey, separate the activity roles, review the customer and supplier handovers, and assign a change-review owner.
Ownership and scope
Product, engineering, support and commercial owners should review the factual map together. Code changes, security testing and overseas legal conclusions need their own scope.
Common questions
Does this industry label determine our legal obligations?
No. The activities, people, roles, geography and applicable sector requirements need review.
What should we bring to an initial discussion?
Describe one important activity, the teams and providers involved, the records already available and the question you need to resolve. Use examples with unnecessary personal details removed.
Discuss the work you need
Agree the service, deliverables, responsibilities and fees before committing to an engagement.
Related reading
This page explains topics to scope and discuss. It does not establish applicability, certify compliance or confirm a paid engagement.
← Industry examples