1. Recognise personal data beyond the employee directory
Workplace systems contain more than names and email addresses. Device assignments, licence records, approval histories and access events can relate to identifiable people. Combining individually ordinary records can reveal a more detailed picture of someone's working life than any one source provides.
The operational challenge is to make necessary information usable without collecting everything simply because it is available. Excess data increases exposure, complicates access requests and makes retention harder to manage. Start with an inventory of the information involved in a specific process, including exports and manually entered notes.
- Identify which fields relate to people and where those fields originate.
- Include indirect identifiers such as assigned device references in the review.
2. Define purpose and minimise collection
Purpose limitation means specifying why information is processed and checking whether subsequent uses are compatible with that purpose. Data minimisation means using information that is adequate, relevant and limited to what is necessary. A technically available field is not automatically a justified field.
For a fictional device-return process, an employee reference, assigned asset, return contact and completion status may be sufficient. Salary information or unrelated HR notes would not normally support that task. This example illustrates a review method, not a universal field specification or legal conclusion.
- Write a purpose statement before approving an integration's field mappings.
- Remove unnecessary fields and avoid copying unrestricted free-text notes.
- Review new reporting uses rather than assuming the original purpose covers them.
3. Restrict access and maintain accuracy
Access should follow responsibilities. A person coordinating equipment returns may need different information from someone reviewing employment records. Restrict editing and exporting as well as viewing, and reassess access when responsibilities change.
Lojycal has organisation membership and role restrictions, tenant-scoped access controls, and MFA/passkey capabilities. Its employee integration paths include preflight confirmation and re-read verification for supported writes. These controls can support responsible operation, but do not establish that source information is correct or that a workspace is configured appropriately.
- Confirm permissions, mappings and supported actions for your plan and workspace.
- Assign responsibility for resolving conflicting records and documenting corrections.
- Distinguish a verified successful write from verification that the underlying personal information is accurate.
4. Manage retention across copies and evidence
Retention should reflect a documented purpose and applicable requirements, not indefinite storage by default. Different information categories may need different treatment. Operational records, audit information and downloaded evidence can have distinct constraints, so removing a source record may not resolve every retained copy.
Lojycal includes append-only audit and signed evidence export mechanisms. Their integrity features do not decide whether keeping particular personal data is lawful. Do not assume that every record is immutable or that an export replaces a retention policy.
- Ask about applicable retention behaviour, deletion handling, backups and exported copies.
- Confirm current information through /data-retention, /privacy and the team.
- Set review ownership for retention decisions and exceptions, including legal preservation requirements where applicable.
5. Clarify responsibilities under the GDPR
Under the GDPR, the controller determines processing purposes and means, while a processor acts on the controller's behalf within the agreed framework. Establish the roles for each activity rather than assuming one label describes every relationship. The organisation must assess lawful basis, transparency, rights handling and any need for a data protection impact assessment.
Using Lojycal does not automatically make a customer GDPR-compliant. Appropriate technical and organisational safeguards also require internal policies, trained staff, incident procedures and accountable decision-making. Involve your privacy or legal advisers where the processing requires specialist judgement.
- Review the current /dpa and /sub-processors information and applicable /commercial-terms.
- Confirm hosting, transfers, contractual responsibilities and incident-related obligations with the team; do not infer them from product features.
6. Evaluate a complete information journey
Before connecting a system, trace one representative record from collection through use, correction, export and eventual retention review. Include how your organisation would locate relevant information for a rights request and assess lawful exceptions. This reveals practical gaps that a general privacy statement cannot resolve alone.
Use synthetic data for the initial walkthrough. Record unanswered questions, their owners and the evidence needed before proceeding. Lojycal can connect operational information, but your organisation still needs to decide which processing is appropriate and review whether the configured workflow matches that decision.
- Proceed only after purpose, permissions, responsibilities and information-handling requirements have been reviewed.