GDPR Compliance and Secure Data Handling

Not a technicality, and the useful part is that the rules point at the same thing good practice does.

The relevant principle is that personal data must be adequate, relevant and limited to what is necessary, and kept in identifiable form no longer than necessary. So the test on any line in that spreadsheet is whether the next person genuinely needs it to help her. Much of what makes notes feel thorough fails that test.

The part that most services get wrong is the kind of detail rather than the amount. Notes about health, religion, ethnic origin, sexual life or political opinion are special category data under Article 9 and are prohibited unless a specific condition applies. In mentoring these arrive as free text without anyone deciding to collect them: a line about a mentee's asylum claim, her diagnosis, why she left. Once written, that sits in a spreadsheet with ordinary contact details and gets shared as if it were the same thing.

A practical rewrite rule: write what the next mentor must do, not what you were told. Needs childcare-compatible hours and a written summary after each session is useful and carries no special category data. The sentence explaining why does not need to be there.

That rule is easy to apply. Is there anything we should have in place that we probably do not?

Three things, in the order they tend to be missing.

A retention rule that someone actually applies. Not a sentence in a policy, a date in the calendar and a person whose job it is. Decide now what happens to these records when the project ends, because unowned files outliving their purpose is the most common failure in project-funded work.

A way to answer a mentee who asks what you hold about her. She has the right to ask and to see it, and if the answer lives in one person's spreadsheet and another person's inbox, you cannot answer honestly.

And a plan for when something goes wrong. A personal data breach has to be notified to the supervisory authority without undue delay and where feasible within 72 hours of becoming aware of it, unless it is unlikely to be a risk to people. Seventy-two hours is not long enough to work out who to call while it is happening. Have the name written down before you need it.

We went through the spreadsheet with that rewrite rule and removed about a third of it in an afternoon. The part I had not expected: two colleagues said the notes were more useful afterwards, because what was left was what they needed to act on rather than everything anyone had ever been told.