Keeping a record of what you decided, not just the outcome

Aug 29
3 min read

Updated: 4 days ago

Introduction

A business assesses whether a marketing approach is lawful, concludes that it is, and proceeds. Somebody complains eighteen months later and a regulator asks how the decision was reached. The reasoning was sound and exists nowhere.

Most data protection frameworks require not only compliance but the ability to demonstrate it. A business that considered a question carefully and wrote nothing down is in the same position as one that never considered it, which is the point owners find hardest to accept and the one that matters most when something is examined. Good judgement leaves no trace unless somebody writes it down.

1. Keeping a record of what you decided is the accountability requirement

The principle behind it.

Frameworks generally require you to be able to show how you comply, not merely to comply. That means the reasoning behind decisions is itself something to be documented.

2. Record the decisions, not the policies

Where businesses get this backwards.

A folder of policies nobody follows is worth less than a short note of an actual decision and why it was taken. The policies describe intentions; the notes describe what the business did.

3. Write down the balancing assessments

Specifically expected in most regimes.

Where you rely on legitimate interests, the assessment weighing your purpose against the individual's rights should be recorded. It is a short exercise and it is one of the more commonly requested documents. It also forces the assessment to be made properly rather than assumed.

4. Note why you decided not to report a breach

The record that protects you.

Where an incident was assessed and did not meet the threshold, the assessment and reasoning are what demonstrate that the decision was taken properly. Unrecorded non-reporting is indistinguishable from concealment.

5. Keep the reasoning behind retention periods

Not just the periods.

Why each category is kept for the stated time — a legal requirement, a limitation period, an operational need. A schedule of numbers with no justification is difficult to defend when queried.

6. Record how requests were handled

Both the response and the process.

What was searched, what was provided, what was withheld and on what basis. Requests are frequently followed by a complaint about the completeness of the response, and this is the answer to it.

7. Document supplier decisions

Why you chose them and what you checked.

The assessment of a processor's security, the terms accepted, and any transfer arrangements. Choosing a provider is a decision about your data and it should leave a trace.

8. Keep it proportionate and simple

Not a compliance industry.

For a small business this is a handful of short notes and tables, not a management system. Something that takes an hour to produce and is actually kept is worth more than an elaborate framework nobody maintains.

9. Date everything and keep it findable

The practical requirement.

A single location, dated entries, and somebody who knows where it is. Records that exist across several inboxes cannot be produced when they are needed, which is functionally the same as not having them.

Review the file annually alongside your data inventory and retention schedule. These three documents together are essentially the whole of what a small business needs, they take an afternoon between them, and they are what convert good intentions into a position you can actually demonstrate.

Conclusion

Document the reasoning, because compliance you cannot demonstrate counts for very little.

Record decisions rather than accumulating policies nobody follows, write down balancing assessments where you rely on legitimate interests, note the reasoning when you decide an incident is not reportable, keep the justification behind each retention period, record how each request was handled including what was withheld and why, document why you selected each supplier and what you checked, keep the whole thing proportionate to a small business, date everything and store it in one findable place, and review it annually with your inventory and retention schedule.