Personal data in business: what to check on a website and in the office

List categories of information, sources, reasons for processing and who has access. Do not ask for identity documents or confidential legal facts in a general inquiry form unless genuinely necessary.

Processing should have an appropriate legal basis; consent is not the only possible basis and should not be used as a blanket substitute. Explain purposes, recipients and relevant rights in accessible language.

Email services, analytics platforms and form providers may receive submitted information. Review their roles, security and any cross-border transfer requirements before configuring them.

Limit access by role, establish deletion or review procedures, and arrange a process to respond to data-subject requests. Avoid making retention promises the business cannot actually meet.

A privacy notice cannot substitute for a real data-flow inventory: where data enters, who accesses it, the purpose, retention period and service providers involved. Contact forms, analytics, job applications and client case files present different risks. For each processing activity record its legal basis, access permissions and whether retention remains necessary.

Define who receives internal reports of lost data, unauthorized access or misdirected communications. Record the incident timeline, scope, potential impact and remedial measures. Legal review should determine whether the current law requires notification to the supervisory authority or affected individuals. A prepared notification template is useful but does not replace factual assessment.

A publicly visible privacy notice cannot correct an unlawful internal data flow. Start from the real operation: who collects which personal information, for what purpose, how long it is retained, who can access it and where it is transferred. Distinguish the legal basis for responding to an enquiry from separate marketing use, employee monitoring or analytics. Check processor agreements with web-form providers, payroll vendors and cloud platforms, including access controls and international transfers. Record how a person can request access, correction or other applicable rights and who is responsible for responding. A data incident process needs owners and decision points rather than a promise that every breach will be impossible. Review current Georgian law and any cross-border obligations for the actual business model.

A law firm website collects a name, phone number and short description of the matter. If submissions go directly to a third-party form provider, a statement that data is “secure” is not an adequate processing description. Map the purpose, provider role, retention, access controls and any international transfer. A case description may include sensitive information; the form should seek only what is genuinely necessary for an initial response.