Checklist · Updated 23 October 2026
Privacy throughout the customer journey.
Examine how customer data is collected, used and passed through your systems. Use this checklist to identify questions and assign someone to resolve them.
Use the templateto know what?
Purpose. Access. Retention.
A list of questions to resolve, documentation and responsible people.
The process owner, system administrator and privacy expertise where needed.
See it in practiceFrom a situation to a next step
Illustrative example · not a client case
A form sends information to email, a CRM and a spreadsheet. Nobody has a complete overview of who uses these copies.
- Investigate
Draw the actual data flow. Examine the purpose of each copy, access permissions, suppliers and how long the information is retained.
- Try
Assign an owner to each unresolved processing question. Document the assessments and update procedures and information to match the actual setup.
- Follow up
Do you know where the data is, why it is there and who handles access, rights and deletion?
01 / 06
Purpose and lawful basis
Describe which personal data you process, why and on which lawful basis. Assess each purpose before collection begins. Responding to an enquiry and sending later marketing are different purposes.
02 / 06
Clear information
Explain what happens to personal data where the customer needs that information. The notice must match the actual setup: purposes, controller, recipients, storage and rights. An old standard document may describe tools you no longer use.
Norwegian Data Protection Authority: Information and transparency
03 / 06
Consent for tracking
Map cookies and other technologies that store or access information on a device. Where consent is required, obtain it before using the technology. Assess any strictly necessary exemption specifically. Saying no should be as easy as saying yes, and withdrawing consent should be easy.
04 / 06
Suppliers and data flows
Find out who processes information on your behalf and arrange the necessary data processing agreements. Check subprocessors, storage locations and possible access from outside the EEA. A European server location alone does not resolve the entire transfer question.
Norwegian Data Protection Authority: Data processing agreements
05 / 06
Access and security
Grant access according to need and review it when roles or staff change. Assess risks, account protection, backups and procedures for errors or incidents. Check that integrations do not provide broader access than the task requires.
06 / 06
Retention, deletion and rights
Determine how long the information is needed and clarify any duty to retain records. Test correction, access and deletion across systems. Deleting data from the CRM does not automatically remove copies in other tools.
Norwegian Data Protection Authority: Correction and deletion
See also Norwegian guidance on transfers outside the EEA and the overview of business obligations.
Agree on a commitment.
One practical improvement is a good place to start. Agree on who will take it forward and when you will review whether it works. The plan is included when you download your notes.
Let’s talk