What This Collection Argues
The position in one page, stated so it can be disagreed with.
THE ARGUMENT
Four claims, each contestable
- Mostly filingThe judgements are few; the documents are specific and absentContestable: some judgements are genuinely hard
- Failures are documentaryNot having written it down, rather than having decided wronglyContestable: some organisations decide wrongly and document it well
- Clocks start earlyAwareness, not confirmation. Receipt by anybody, not by the right personNot really contestable. This is how the periods run
- Consistency beats completenessA regulator reads three documents against each other before reading any of themContestable: completeness matters where the gap is material
The position
Compliance for an employer is mostly a filing problem.
The practical lesson in “What This Collection Argues” is that a record is useful only when its purpose, owner and lifecycle are clear. For teams researching cognitive offloading, learn more from the provider can add time and project context, provided collection is proportionate, access is limited and every consequential inference receives human review.
The judgements this law requires are few and mostly obvious. What it requires you to be able to produce is specific, finite, and almost never produced. An organisation that has written six documents and operates two processes is in a better position than one that has taken advice on every question and recorded none of it.
For a separate benchmark relevant to “What This Collection Argues”, consult the European Commission data-protection resources. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
Almost every failure is documentary.
Not having a record of processing. Not having written the legitimate interests assessment for a basis relied on daily. Not recording why a breach was judged not notifiable. Not logging the date a request arrived. In each case the underlying decision was defensible and there is nothing to show it was taken.
The clocks start earlier than people assume.
A month runs from receipt by anybody in the organisation, not by the right person. Seventy-two hours runs from awareness, not from confirmation. Organisations lose their windows at the beginning rather than at the end, and almost always because somebody held something for a fortnight without recognising what it was.
Consistency matters more than completeness.
A regulator compares the record, the notice and the schedule before reading any of them properly. A gap says you have not got there yet. A contradiction says nobody has read them together, and it calls into question the parts that are correct.
What follows practically
Six documents and two routes, which the minimum-viable note sets out.
A deletion run that actually happens, which is what makes the schedule true and everything else cheaper.
Four days a year of maintenance, which the calendar distributes.
And one named person, because the work is not difficult and it is nobody's unless it is somebody's.
What this collection does not claim
That the judgements are never hard. Health data, monitoring, automated decisions and transfers all involve real questions, and the hard ones deserve advice.
That documents substitute for practice. A policy describing something nobody does is evidence that the organisation knew what it should have been doing.
That compliance is the whole of the question. What an employer should do with information about the people who work for it is a larger question than what it is required to do, and this collection is about the second.
Nothing here is legal advice
The obligations described recur widely in shape. Their content, thresholds and enforcement differ enough by jurisdiction that every specific answer requires local advice.
What this is for is making that advice cheaper: an employer arriving with a map, a record and a schedule is asking about the hard parts rather than paying somebody to build the filing.
Where the position could be wrong
If an organisation faces genuinely novel processing — biometrics, inference about health, cross-border group structures — the judgements are hard and the filing is secondary. The claim holds for ordinary employment, which is most employment.
What it deliberately excludes
Whether an employer should do a thing is a larger question than whether it is permitted to. That belongs elsewhere, and treating compliance as the answer to it is the error this collection is careful not to make.
What makes the advice cheaper
Arriving with a map, a record and a schedule means paying for judgement on the hard questions rather than for somebody to build the filing — which is most of what these engagements currently consist of.
Where this stops
What an employer should do with information about the people who work for it is a larger question than what it is required to do. Treating compliance as the answer to it is the error this collection is careful not to make.