An imagined amethyst umbrella shelters three envelopes while loose paper fragments drift beyond it, symbolising careful choices about the information an organisation keeps.
Every name, address and private detail an organisation keeps deserves a clear purpose, a responsible owner and a plan for what happens next.
By Arbab Naseebullah Kasi, Chief Executive Officer - CEO, Feel Worldwide Foundation Inc.
The event ended months ago. The borrowed equipment went back. The receipts were filed. Someone wrote a short account of what the community had learned.
The registration spreadsheet stayed.
Imagine a small organisation finding that spreadsheet while preparing its next programme. It contains contact details, home addresses and a column where participants explained what support they needed. Several people downloaded copies when they were helping with the event. Nobody can quite remember why the addresses were requested, who still has access or when the information should be reviewed.
This is an illustrative situation, not an account of a particular organisation. Its central problem is easy to recognise: a temporary activity has left behind a continuing responsibility.
Digital storage makes it possible to keep information without noticing the weight of it. A spreadsheet occupies little visible space. It does not stand in the doorway asking for attention. Yet the people described in it still have an interest in how their information is used, protected and eventually disposed of.
For a small business, charity or community group, responsible data practice begins with an ordinary question: can we explain why we hold this information now?
Start with the person behind the record
A participant may give a telephone number because they want to hear if an event is cancelled. They may describe a practical difficulty because they want to attend. Neither conversation should quietly become an unlimited invitation to keep building a profile of them.
Consider how our imagined participant might see the situation. They remember asking for help arranging access to a room. The organisation remembers a useful column in an old file. The difference between those perspectives is where a privacy problem can begin.
The United States National Institute of Standards and Technology makes an important distinction in its Privacy Framework guidance: managing cybersecurity risk contributes to privacy, but does not address every privacy risk. Problems can arise through ordinary data processing, even without a security incident. Its voluntary framework considers potential effects on people throughout the life of information, from collection to disposal. Read NIST's introduction to privacy risk management.
That distinction changes the discussion. A well-protected database can still contain details the organisation cannot justify holding. A file can be shared through an approved system and still be sent to someone who has no reason to see everything in it.
I would like us to bring the participant's perspective into routine administrative decisions. What did they reasonably understand they were providing? What task required it? What would surprise them about its continued use?
Give each detail a specific job
Try completing this sentence for an item of information: we need this because it allows us to do this particular thing.
In the imagined event, a contact method might be needed to send joining instructions. A full home address would require a separate explanation. If organisers only want to understand which neighbourhoods they reached, they should examine whether a less precise answer would meet that purpose.
The European Data Protection Board's guide for small businesses explains data minimisation as processing information that is necessary and proportionate for the intended purpose. It also places that principle alongside lawfulness, transparency, accuracy, security and limits on storage. This is guidance within the GDPR framework, whose application depends on the organisation and its activities. It is not a claim that every reader operates under the same law. Read the EDPB's data protection basics.
For leaders elsewhere, the practical question remains useful: does the work genuinely require this degree of detail?
Sometimes it does. A service may need accurate identifying information to deliver support or meet an obligation. Collecting too little can create its own problems if staff cannot distinguish records or make a necessary decision fairly.
The aim is considered sufficiency. Someone should be able to explain the connection between the information and the work, rather than pointing to a template that has always included the field.
Let curiosity become a research question
Keeping information for a possible future project can sound resourceful. Perhaps the organisation will one day compare neighbourhoods, launch a new service or ask former participants to contribute to a study.
But a possibility is not yet a plan. What question would the proposed research answer? Who would use the findings? Would identifiable records be necessary? What permissions, safeguards and expertise would the work require?
A team that can answer those questions may discover a worthwhile project. A team that cannot is not helped by accumulating private details indefinitely.
The Federal Trade Commission's business guidance recommends avoiding unnecessary collection, retaining information only while there is a legitimate business need, and using fictitious information where real personal data is unnecessary for training or development. The guidance draws lessons from enforcement cases, while noting that settlements are not court findings. Read the FTC's Start with Security guide.
This offers a particularly useful habit when trying new technology. To test whether a spreadsheet template or demonstration works, invent a small set of clearly fictional records. There is no educational advantage in exposing a real participant's private circumstances merely to make a practice screen look convincing.
If a later project genuinely needs real information, assess that use on its own terms. Having a file available does not answer whether using it is appropriate.
Decide what happens after the activity ends
The closing checklist for our imaginary event might cover payments, venue keys and equipment. Personal information deserves a place on that checklist too.
Different records may need different treatment. Financial documents, attendance information and temporary arrangements should not automatically inherit one indefinite retention period just because they were stored together.
Canada's Office of the Privacy Commissioner explains that there is no single retention period suitable for every situation. Its guidance recommends considering the original purpose, applicable legal requirements and the need to let people understand or challenge decisions made about them. It also calls for secure disposal and attention to copies and backups. These are Canadian regulatory materials, not a universal schedule that can be applied without checking local obligations. Read the Commissioner's retention and disposal guidance.
The decision therefore needs an informed owner. Before removing records, check applicable retention duties, grant conditions, pending requests, complaints and legal preservation requirements with the appropriate person. A tidy folder is not worth destroying information that must be preserved.
For records that can appropriately be removed, decide how that will happen and who will verify it. A reminder to review a file is more useful than a quiet assumption that someone else will eventually remember.
Follow the copies without creating more of them
Return to the old event spreadsheet. The main version may be easy to find. The working copies deserve attention as well.
One might have been exported for check-in. Another may be attached to an email. A helper might have printed a list to use at the entrance. An online platform may retain its own record after an export has been removed.
The practical starting point is to ask the people who handled the information how the work actually happened. Avoid turning this into a blame exercise. If the approved process was awkward, staff may have developed workarounds without understanding their consequences.
Record the locations and responsible people rather than gathering every private file into another large collection. Ask the relevant service provider or technical lead how deletion, version history, backups and account closure work. Make sure the organisation's promises match the systems it uses.
Do not describe a record as permanently erased simply because it disappeared from one screen. Where information must remain in restricted backups for a period, understand and document that arrangement. Technical disposal should be handled through an appropriate, verified process, not improvised by someone trying to finish a cleanup quickly.
This work may reveal that the easiest improvement is to stop creating a particular copy in the first place.
Preserve useful learning without preserving every private detail
An organisation should be able to remember its work. It may want to know which sessions were popular, where participation was difficult and what to improve next time.
Those questions deserve deliberate records. A short account of an event can explain that the venue entrance caused difficulties and describe the changes planned for the next programme. It may not need to carry forward the names of everyone who reported the problem.
When producing summaries, be careful about claiming anonymity. A distinctive account of one person's circumstances can identify them within a small community even if their name is missing. Consider who will read the material and what they could infer. Seek suitable advice where the risk is unclear.
There is also a difference between evidence for improvement and material for publicity. A private explanation given to arrange support should not simply become a compelling story in a fundraising presentation. Any proposed public use deserves a separate, careful conversation and appropriate permission.
The useful question is what knowledge the organisation needs to carry forward. Sometimes a broad finding, a revised procedure and an honest note about limitations will serve that purpose better than another folder of personal accounts.
Make the smaller decision visible
An organisation does not have to begin with a dramatic overhaul. It can choose one completed activity, identify the records it produced and work through the outstanding decisions with the right people.
Which details still serve a clear purpose? Which obligations require retention? Who needs access? Which copies should be removed through the approved process? What should change before the next activity begins?
Write down the decisions in plain language. Give each unresolved question an owner. Explain the resulting process to staff and volunteers who will actually use it. Review whether the change works when the next event is busy, rather than assuming a written instruction will be enough.
Success need not be measured by the number of files deleted. It may be a questionable field removed from a template, a retention decision finally clarified or a participant receiving a straightforward explanation of how their information is handled.
The old spreadsheet at the beginning of this story does not require panic. It requires attention, judgment and a responsible next step.
People give organisations information because they want something to happen: an appointment arranged, a service delivered, a question answered. We should be able to explain how the details we keep continue to serve that purpose.
And when they no longer do, we should already know what comes next.
