Privacy checklist

This is not legal advice. Use it to prepare conversations with counsel and vendors.

Data map (one page)

• What personal data do we collect? (members, visitors, staff, leads)
• Where is it stored? (which tools, which regions)
• Who can access it? (roles, vendors, integrators)
• How long do we keep it?
• How do people request export/deletion?
• What happens on vendor offboarding?

High-risk patterns

• CCTV without signage/policy
• Member “relationship CRMs” without transparency
• Public calendars exposing personal meeting titles
• Chat logs retained forever
• Analytics without consent where required
• Shared staff logins (no audit trail)

Prefer

• Data minimization
• Role-based access
• Short retention for video and raw logs
• Privacy-friendly analytics when marketing metrics suffice
• Documented subprocessors for SaaS