Personal data with no plan

Personal data is any information about a person who can be identified. A name and an email address, of course. But also a phone number, a photo, an order number, a location, an IP address, or a voice in a recording. If the data points to one person, alone or together with other data, it's personal.

GDPR is the European law on personal data. Many people believe it's only for big companies. In fact, it applies to every organisation that handles personal data: a start-up, a bakery, a student association, a freelancer. It applies to you too, from the day your portfolio's contact form receives its first message.

Some data is more sensitive than the rest. Health, religion, political opinions, sexual orientation, ethnic origin, trade union membership and a few others are special categories, with stricter rules. They often arrive without anyone noticing. A pharmacy's order history reveals its customers' health. A union's list of members reveals more than names.

Last, removing the names doesn't make data anonymous. A table of orders without names still holds email addresses, delivery addresses and order numbers, and each one points to a person. Data is anonymous only when nobody can find the person again, even with other data.

Forms grow by habit. A field stays because the old paper form had it, or gets added because it might be useful one day. Before a form goes live, ask one question for each field: why do we need this? GDPR calls this data minimisation. A form collects only the data that its purpose requires.

Take a museum that wants a form for teachers to book a class visit. The museum needs the teacher's name, the school, an email address to confirm the visit, and a phone number to call on the day if something changes. It needs the number of pupils, to plan the guides. But the form also asks for each pupil's name and date of birth, the parents' phone numbers, and a list of the pupils' illnesses and disabilities. None of this helps to run the visit, so remove it. The museum only needs to know whether someone in the group needs step-free access or a seat. Ask that, and nothing about illnesses: health data is sensitive, and data about children needs extra care.

Every field you remove is data the museum never has to protect. It can't leak, and the museum never has to justify it if a teacher, a parent or the CNIL asks. And don't accept "they agreed, they filled it in". People complete whatever a form asks. The organisation stays responsible for having asked.

If you're the professional, as a freelancer or an agency, saying this is part of your job. In France, it's called the duty to advise. The client decides, but you must tell them.

The example below shows the museum's form twice. On the left, it's the form as the museum wrote it. On the right, each field that is left has a reason, written next to it, and a short notice under the form tells teachers what happens to the data.

Before a form goes live, four things must be decided. Deciding them later is too late, because the data is already there.

• Why: the purpose of each piece of data, as in the last part.
• How long: when the data is deleted, and who deletes it. This is the retention period. The visit bookings can be deleted a few months after the visit. For the contacts of possible customers, the CNIL's usual guideline is three years after the last contact.
• Who sees it: only the people who need it for the purpose. The bookings team and the guide of the visit, not the whole museum.
• Where it goes: which tool stores it, under whose account, and in which country.

Then tell people the answers, in a short notice next to the form: what you collect, why, for how long, and whom to contact. People have rights over their data. They can ask what you hold about them, and ask you to delete it. You can only answer if you know where everything is.

Your portfolio's contact form needs this plan too, and it fits in four lines. You collect a name, an email and a message, to answer the sender. You keep them for one year, then delete them. Only you can read them. They're stored in your form service and in your inbox. Write those four lines under the form.

Personal data rarely stays in one place. Each tool that touches it belongs to another company, which receives the data. That company may keep it, use it for its own purposes, or store it outside the European Union. Some of these tools were chosen carefully. Many were not.

Take an agency that rents out flats. A tenant's application arrives through the site's form service, then goes to the agents' email. An agent merges the tenant's payslips with a free PDF website, because it's quick. Another pastes the tenant's situation into a free AI chatbot to write a letter. And the site loads advertising trackers on every visit. Nobody decided any of this. It happened because each tool was convenient.

Under GDPR, the agency stays responsible for that data, wherever it goes. So sending personal data to a tool must be a decision:

• A reason to send it, linked to the purpose.
• A provider whose terms have been checked, with a signed contract that says what it may do with the data. This is a data processing agreement.
• People who are told, in the privacy notice. For trackers and other tools that the site doesn't strictly need to work, visitors must agree before the tools load.

Watch free plans in particular. Free and personal AI plans often use what they receive to improve their models, unless you switch that off. Business plans usually don't.

Two habits turn a small incident into a large breach. Data is kept forever, and everyone can see it.

Take a language school that writes visa letters for its foreign students. For each letter, it scans the student's passport. Since 2012, every scan has gone into one shared folder, which all 30 teachers can open. Nobody needs a 2013 passport today. But one hacked teacher account, or one stolen laptop, now exposes thousands of passports, of people who left years ago.

GDPR asks for two limits. Keep data only as long as its purpose needs, then delete it or anonymise it. And give access by role: only the people who need the data can see it, and fewer still can export it. Here, a passport scan is needed until the visa letter is sent. Only the two people who write the letters need the folder.

Think of deleting as a protection, not a loss. Data you no longer hold can't leak, and it needs no protection. Storage is cheap, but a breach of data that you didn't need is not.

And watch exports. A spreadsheet downloaded to a laptop, or sent by email, escapes every access rule. Ask who can export the data, and why.

Ask these questions before any form, tool or import that handles personal data goes live. Ask them again whenever a new tool is added.

For each field, ask why it's needed, and remove the ones with no answer. Ask how long the data is kept, who deletes it when that time is up, and whether that happens automatically. Ask who can see it and who can export it, and whether that matches their jobs. Ask where it's stored, and which tools receive it: the form service, the email, the analytics, any AI tool. For each one, ask under whose account it runs, what it does with the data, and whether a contract has been signed. Then check that the notice next to the form says all this.

Ask who handles GDPR in the organisation. Large organisations have a DPO, a data protection officer. Smaller ones still need a named person. Tell them about a new tool before it starts receiving personal data, not after.

For your portfolio, ask yourself the same questions. Does the contact form ask only for what you need to answer? Do you know where its messages are stored? Is there a short notice under it? And if you add analytics, does it need a consent banner, or can you choose a tool that doesn't track people?