The Myths That Cost Money
Eight beliefs that are wrong, widely held, and expensive in both directions — some produce unnecessary spending and some produce real exposure.
BELIEF AGAINST POSITION
The eight that recur
- We are too small to need a processing recordThe exemption is narrow and employment rarely fitsCosts: the first document a regulator asks for
- We need a data protection officerRequired only in defined casesCosts: an appointment nobody needed
- Consent covers usUnreliable in employmentCosts: a basis that collapses when examined
- We must delete everything on requestErasure is narrow and usually unavailable hereCosts: records destroyed that were needed
- Anonymised, so outside the rulesUsually pseudonymised, so inside themCosts: processing with no basis
- Certification means they are compliantScope matters more than the badgeCosts: diligence that establishes nothing
- A breach means an attackAny loss or wrong disclosure countsCosts: under-reporting, and the clock running
- The policy is the complianceDocuments without practice are evidence of nothingCosts: everything above, at once
Some of these produce unnecessary spending. Others produce exposure. All eight are held confidently.
The practical lesson in “The Myths That Cost Money” is that a record is useful only when its purpose, owner and lifecycle are clear. For teams researching internal transfer policy, open the official page can add time and project context, provided collection is proportionate, access is limited and every consequential inference receives human review.
"We are too small to need a record of processing"
The exemption is narrow and falls away where processing is regular or involves special category data. Employment processing is both.
For a separate benchmark relevant to “The Myths That Cost Money”, consult the U.S. Department of Labor work-hours guidance. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
Cost of the belief: the absence of the first document anybody asks for.
"We need a data protection officer"
Required for public authorities, for large-scale systematic monitoring as a core activity, and for large-scale special category processing as a core activity. Most employers meet none of these.
Cost: an appointment, a salary or a retainer, for a role that was not required — while the actual work still goes unowned.
"Consent covers us"
It does not, for the reasons in its own note. What covers most employment processing is necessity.
Cost: a basis that collapses the first time it is examined, and a withdrawal right nobody planned for.
"If they ask, we must delete everything"
Erasure is available in defined circumstances, most of which do not apply where processing is necessary for the contract, a legal obligation, or defending claims.
Cost: records destroyed that were needed, in response to a right that did not apply.
"It is anonymised, so the rules do not apply"
If it can be reversed, it is pseudonymised and the rules apply in full. Most data organisations call anonymous is pseudonymised.
Cost: processing conducted on the assumption of being outside the rules, with no basis and no notice.
"They are certified, so they are compliant"
Certification is evidence with a scope. A certificate covering a different service than the one you buy establishes nothing about yours.
Cost: diligence that produced a file and no knowledge.
"A breach means an attack"
It means any accidental or unlawful destruction, loss, alteration or unauthorised disclosure. The commonest employment breach is an email to the wrong person.
Cost: under-reporting internally, and seventy-two hours spent deciding whether something counted.
"We have the policies, so we are compliant"
The documents matter because they describe a practice. Where there is no practice they are evidence that the organisation knew what it should have been doing.
Cost: all of the above, simultaneously, discovered at once.
Why these are held confidently
Each contains something true. The exemption exists, certification is evidence, erasure is a right. The error is in the scope, which is where confident wrong beliefs usually live.
The one that costs most
That the policies are the compliance. Documents describing a practice that does not exist are evidence the organisation knew what it should have been doing, which is worse than having neither.
The pattern in all eight
Each contains something true and errs on scope. The exemption exists but is narrow; certification is evidence but has a scope; erasure is a right but a limited one.
Where each belief comes from
A true statement with the scope removed. That is the shape of every one of the eight, and it is why they are held by sensible people rather than careless ones.
Why the eighth is the expensive one
Documents describing a practice that does not exist are evidence the organisation knew what it should have been doing. That is a worse position than having neither, and it is the commonest state.