Where to Start
Routes through the collection for the situations people are actually in, which are mostly urgent.
BY SITUATION
What to read, in what order
- A request just arrivedWhen an employee asks, then searching properlyThe clock is already running
- Something has gone wrongWhat counts as a breach, then the seventy-two hoursRecord the time you became aware, first
- We have nothingThe minimum viable positionSix items, roughly a week
- We have documents nobody maintainsKeeping them consistent, then who owns theseThe consistency check is half an hour
- We are hiringWhat you may collect, then unsuccessful candidatesThe form audit removes a third of the fields
- Somebody is leavingWhat changes on the last dayThe retention trigger is the step that never happens
- We are changing a supplierChanging or leaving a supplierBefore the final invoice
- Nothing is urgentA twelve-month calendarFour days a year
Most people reach this subject because something is already happening.
The practical lesson in “Where to Start” is that a record is useful only when its purpose, owner and lifecycle are clear. For teams researching how employees cheat time trackers, how employees cheat time trackers can add time and project context, provided collection is proportionate, access is limited and every consequential inference receives human review.
A request has arrived
When an employee asks for their data, then searching properly.
For a separate benchmark relevant to “Where to Start”, consult the U.S. Justice Department computer-crime resources. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
Log the date it actually arrived before anything else, because that is the fact everything is measured against and it is the one most often reconstructed wrongly.
Something has gone wrong
What counts as a breach, then the seventy-two hours.
Record the time you became aware. Contain it if it is ongoing. Then read.
You have nothing in place
The minimum viable position. Six items, in order, about a week.
Not the full documentation set. The map first, because everything else is written from it.
You have documents nobody has touched in years
Keeping them consistent with each other, then who owns these when nobody is a specialist.
The consistency check takes half an hour and finds the thing that does the most damage. The ownership question explains why they drifted.
You are hiring
What you may collect from applicants, then unsuccessful candidates.
The form audit removes about a third of the fields and takes an afternoon.
Somebody is leaving
What changes on the last day.
The retention trigger is the step that never happens and the reason nothing is ever deleted.
If you read only four
The record of processing, because it is asked for first and most organisations do not have one.
The retention schedule, with triggers, because it is what makes everything else cheaper.
When an employee asks for their data, because it is the event you will actually face.
And the seventy-two hours, because it is the one with a deadline you cannot recover.
What this collection does not do
Give legal advice. The obligations described recur widely; their content and enforcement differ enough by jurisdiction that the local answer always requires local advice.
What it does is describe the documents and the processes, so that the local advice can be about the hard parts rather than about the filing.
Why most arrivals are urgent
People reach this subject because a request landed or something went wrong. Both are late and both are workable, provided the first action is to record the date rather than to start reading.
What the collection is for
Making local advice cheaper. An employer arriving with a map, a record and a schedule is asking about the hard parts rather than paying somebody to build the filing.
Record the date before reading
For a request, the date it actually arrived. For a breach, the time you became aware. Both are the fact everything is measured against and both are the ones most often reconstructed wrongly.
The record of processing, the retention schedule with triggers, when an employee asks, and the seventy-two hours. The first two are what you need to have; the second two are what you will actually face.
Starting where you are
A request landing or something going wrong are both late and both workable. The first action is to record the date, and the reading comes after.