Keeping Them Consistent With Each Other
A regulator compares the documents before reading any of them. Contradiction is a worse finding than absence, and it is the easier one to produce.
CONSISTENCY CHECK
Run against any two documents, twice a year
- ActivitiesEvery activity in the record appears in the noticeA purpose you process for and do not disclose is the serious version
- BasesThe basis in the notice matches the basis in the recordDifferent documents naming different bases for one purpose
- RetentionPeriods in the schedule match periods in the noticeThe commonest contradiction by a distance
- RecipientsSuppliers in the record appear in the noticeA processor nobody disclosed
- TransfersTransfers in the record appear in the noticeHosting location changes and nobody updates the notice
- DatesAll three documents reviewed within the same cycleA notice from 2019 against a record from last month
- OwnerOne named person for all of themSeparate owners produce divergence within a year
The record of processing, the privacy notice and the retention schedule describe the same organisation. A reader comparing them finds out immediately whether anybody is maintaining them.
The practical lesson in “Keeping Them Consistent With Each Other” is that a record is useful only when its purpose, owner and lifecycle are clear. For teams researching productivity software for business, the official site can add time and project context, provided collection is proportionate, access is limited and every consequential inference receives human review.
Why contradiction is worse than a gap
A gap says the organisation has not got to something yet.
For a separate benchmark relevant to “Keeping Them Consistent With Each Other”, consult the Forcepoint insider-threat overview. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
A contradiction says the documents were produced separately, by different people, at different times, and that nobody has read them together. It calls everything else in the file into question, including the parts that are correct.
And it is specific: a retention period of three years in one document and six in another is not a matter of interpretation.
Where the contradictions sit
Retention, almost always. The schedule is maintained by whoever runs the systems, the notice by whoever drafted it at hiring, and they diverge within a year.
Lawful basis. The notice says consent, the record says legitimate interests, and nobody can say which is operative.
Suppliers. A processor appears in the record and not in the notice, which means people were not told who receives their data.
Transfers. Hosting moves, the record is updated because somebody in IT noticed, the notice is not.
The check
Two columns, half an hour, twice a year.
Activities, bases, retention, recipients, transfers. Does each appear in both documents, saying the same thing.
It is the cheapest piece of work in this entire subject and it prevents the finding that does the most damage.
The structural fix
One owner for all three documents.
Where the record belongs to operations, the notice to HR and the schedule to IT, divergence is guaranteed and no amount of checking keeps up. A single person who updates all three when anything changes is the only arrangement that holds.
Which is the subject of the next note, and in most organisations the answer is that nobody owns any of them.
Running it in half an hour
Two columns, five rows: activities, bases, retention, recipients, transfers. Does each appear in both documents saying the same thing. It is the cheapest work in this subject and it prevents the most damaging finding.
Why separate owners guarantee drift
Where the record belongs to operations, the notice to HR and the schedule to IT, they diverge within a year and no amount of checking keeps up. One owner is the only arrangement that holds.
A gap says you have not got there. A contradiction says the documents were produced separately and nobody read them together, which calls into question the parts that are correct.
One owner, not three
Where the record belongs to operations, the notice to HR and the schedule to IT, divergence is guaranteed. A single person updating all three when anything changes is the only arrangement that survives a year.
Twice a year, half an hour
Five rows across two documents. It is the cheapest work in this collection and it prevents the finding that does the most damage to everything else in the file.
What the check finds
Usually retention, almost always. A period of three years in one document and six in another, maintained by different people who have never compared them.