Data tends to accumulate in useful places: support tickets, exports, analytics, and shared documents. An inventory should explain why those copies exist, who uses them, and how long they are needed.
Ask about purpose
A field should have a reason to be collected. Work with the people who use it to understand that reason before deciding how to reduce or remove it.
Follow the copies
Look beyond the primary database. Exports, test environments, and logs can keep personal information after the original record changes.
Make retention operational
Give retention rules an owner and a mechanism. Verify that deletion jobs run and document justified exceptions.
Original sample editorial content for the preview edition.