The Minimum Viable Position
Where to get to if you are starting from nothing, in the order that reduces exposure fastest.
THE STARTING SET
Six items, roughly a week of work, in this order
- 1. Data mapWhere staff data actually isHalf a day. Everything else depends on it
- 2. Record of processingOne row per activityTwo days, from the map
- 3. Retention scheduleWith triggers and mechanismsOne day, and it is the one that pays back
- 4. Request routeNamed person, logged, with a formTwo hours
- 5. Breach routeFour fields, published, no-blameTwo hours
- 6. Privacy noticeMatching the recordHalf a day, written from the first two
- ThenA date for the first deletion runThe item that makes the rest real
An employer starting from nothing should not attempt everything. There is an order, and the first item makes the rest possible.
The practical lesson in “The Minimum Viable Position” is that a record is useful only when its purpose, owner and lifecycle are clear. For teams researching how to detect mouse jigglers, this workplace technology guide can add time and project context, provided collection is proportionate, access is limited and every consequential inference receives human review.
One: the data map
Where staff data actually is. Half a day with somebody from HR, somebody from IT and a manager.
For a separate benchmark relevant to “The Minimum Viable Position”, consult the SHRM workplace-investigation resources. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
Seven locations, typically. Until this exists, every other document is written from assumption.
Two: the record of processing
One row per activity, eight fields each, built from the map.
Two days. It is the first thing anybody asks for and the thing that most reduces exposure per hour spent.
Three: the retention schedule
Periods with triggers and mechanisms, which the schedule note sets out.
A day. It is the item with the largest downstream effect: everything gets cheaper once the organisation holds less.
Four and five: the two routes
A named person to receive requests, with a log and a short form.
A named route to report breaches, with four fields and a no-blame line.
Two hours each. They are the cheapest items here and they determine whether the obligations with deadlines are met at all.
Six: the privacy notice
Written from the record of processing so the two agree, which removes the consistency problem before it exists.
Half a day.
What is deliberately not on this list
The impact assessments, the legitimate interests assessments, the supplier contract review.
All necessary, none urgent in the first week, and each considerably easier once the map and the record exist.
Then the thing that makes it real
A date for the first deletion run, and somebody named to do it.
An organisation with these six items and a working deletion cycle is in a better position than most organisations with a full documentation set and no practice behind it.
What this costs
About a week of one person's time, spread over a month.
Which is the honest answer to how much work this is for a small employer, and it is considerably less than the amount of anxiety the subject generates.
What is deliberately not on the list
Impact assessments, legitimate interests assessments, supplier contract review. All necessary, none urgent in week one, and each considerably easier once the map and the record exist.
The honest cost
About a week of one person's time, spread over a month. Which is considerably less than the amount of anxiety this subject generates, and that gap is itself worth stating to whoever approves the time.
The order matters
The map first, because everything else is written from it. An organisation that starts with the privacy notice writes a description of an organisation it has not yet examined.
What this actually costs
About a week of one person's time, spread over a month. An organisation with these six items and a working deletion cycle is ahead of most organisations with full documentation and no practice.
Why the map comes first
Until it exists every other document is written from assumption. An organisation starting with the privacy notice is describing an operation it has not examined.