Why does it arrive?
Record the purpose, minimum fields, audience, notice, user choice, source, and any information that should never enter the system.
Data decision map
Trace one record until every copy, choice, and owner is visible.
Begin with a real example—a newsletter address, customer account, support message, analytics event, or identity attribute. Follow it through the product instead of writing a privacy statement disconnected from system behavior.
Who can use it?
Name roles, permissions, processors, automated steps, AI access, manual exports, and the checks that prevent the record being used for another purpose.
Where does it go?
List hosting, vendors, subprocessors, backups, support access, transfer questions, logs, and the route taken when data leaves the primary application.
How does it end?
Define retention, deletion, account closure, backup aging, legal holds, rights requests, incident escalation, and evidence that the action completed.
Analytics note
Separation improves measurement; it does not settle consent.
This Denmark microsite has a dedicated GA4 property and records direct-contact clicks. The organisation still needs a current decision about notice, consent, tag behavior, retention, and any additional tracking used by the actual product. Advertising and profiling tags are not silently part of this service.
Test the user's control
Can a person understand the choice, refuse it, change it later, obtain help, and see the expected result? Can staff fulfil a request without searching uncontrolled spreadsheets and inboxes?
Test the operator's control
Can the owner list every vendor, remove access, investigate an incident, restore service without restoring deleted records indefinitely, and explain what the system did?
Choose one record for the first trace.
Bring the current systems and vendor list, including tools that sit outside the main application.