What Personal Data Do You Actually Hold? (Most Companies Can't Say)

Here's a question that sounds simple: what personal data does your company hold, and where is it?

Most leadership teams can't answer it. Not because anyone is careless, but because personal data spreads. It starts in one system and ends up in five, plus a few spreadsheets, a shared drive and somebody's inbox.

And until you know where it is, you can't protect it, you can't delete it when you should, and you can't answer the person who asks what you hold about them.

Why nobody knows

Personal data doesn't stay where you put it:

• Systems copy it. The CRM syncs to the email platform, the order system feeds the accounting software, the help desk keeps a copy of every conversation.
• People export it. A report to spreadsheet for a one-off analysis. A customer list emailed to a contractor. Nobody deletes the copy afterwards.
• Old systems keep it. The system you replaced three years ago still has a database somewhere, and it was never switched off.
• New tools pull it in. Every new software subscription, and every AI tool someone pastes a customer email into, is another place it lives.

Nobody decided any of this. It just happened, one reasonable shortcut at a time.

Why it matters more now

For a long time, small and mid-sized companies could get away with not knowing. That's changing:

• Customers ask. Bigger customers send security and privacy questionnaires, and "we're not sure" doesn't win the contract.
• More privacy laws apply. Beyond Europe's GDPR, more and more US states have their own privacy laws, and which ones apply depends on where your customers and staff are, not just where you are.
• Breaches need answers fast. If something is stolen, the first question from your insurer, your lawyer and possibly a regulator is: what data, whose, and how much? Some notification deadlines are measured in days.
• People ask for their data. Under several laws, people can ask to see what you hold about them, or have it deleted - and you have a deadline to answer.
• Buyers and investors check. Due diligence looks hard at personal data, and a mess there can change the price.

Map it: six questions for each kind of data

You don't need special software. For each kind of personal data you hold - "customer contact details", "employee payroll records", "job applications" - answer six questions:

1. Whose is it? Customers, prospects, employees, job applicants, suppliers, website visitors.
2. Is it sensitive? Health, financial account details, government ID numbers, children's data. These need the most care, and most laws treat them more strictly.
3. Why do we hold it? If nobody can say, you probably shouldn't.
4. Where is it kept - and who else has it? Every system, and every outside company that stores it for you.
5. Who can see it? Which teams, and when was that last checked?
6. How long do we keep it, and is it actually deleted? "Until we remember to clean up" means forever.

Give each one an owner: a person who can answer questions about it.

Where it hides

When companies do this for the first time, the surprises are usually in the same places:

• Spreadsheets and exports on laptops and shared drives
• Inboxes - resumes, signed documents, customer complaints with personal details
• Shared folders holding HR documents that should be locked down, like sick notes and ID copies
• Old systems that were replaced but never switched off
• Backups that keep everything, including what you deleted
• Vendor platforms - marketing tools, survey tools, analytics - that collected more than anyone realized
• AI tools that staff have been pasting customer information into

Ask the people who use each system. They always know more than the org chart suggests.

Start with the sensitive data

You won't map everything in a day, and you don't need to. Start where the risk is highest: sensitive data with gaps. Health information in a shared folder anyone can open. Bank details kept long after someone left. ID copies with no time limit.

Fix those first. Usually that means one of three things: delete it, lock down who can see it, or encrypt it.

Keep less

The cheapest way to protect personal data is not to have it.

Every kind of personal data needs a time limit - and then it needs to actually be deleted when that time comes, ideally automatically. Data you don't hold can't be stolen, doesn't need protecting, and doesn't have to be found when someone asks.

The question to ask your team

"If a customer asked us tomorrow for everything we hold about them, how long would it take to find it all - and are we sure we'd find it all?"

If the honest answer is "days" or "probably not", the map is your first step.

The bottom line

Privacy isn't mainly a legal problem. It's a knowledge problem: you can't look after what you don't know you have.

Map it, start with the sensitive data, and keep less of it. The rest gets much easier.

Want a head start? The Data Map and Privacy Checklist gives you the map with risk ratings, 20 privacy basics in plain terms, and a log for people's requests.

Free guide: The 45-Minute Tech Spend Checkup - a one-page meeting agenda for finding out whether your technology spending is working.

Related reading

• The Security Questions Every Executive Should Be Able to Answer
• The First Hour of a Cyber Incident: What to Do, and What Not To

Not sure what personal data your business holds? Let's talk. Mapping it is usually a few conversations, not a project. It isn't legal advice, though: for which laws apply to you, talk to a lawyer.