Every data protection obligation assumes you know what you hold and where it goes. A data catalogue records what datasets exist. Lineage records how data moves between them. Metadata describes each one. Together they are the operational version of the record of processing.
The catalogue
For each dataset, the catalogue should hold at least:
- an owner and a steward;
- a description and the purposes it serves;
- whether it holds personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out., and which categories;
- its classification and retention rule;
- the systems it lives in;
- who can access it.
These fields overlap almost entirely with what Article 30 requires in the record of processing. Keep one source of truth and generate the other from it, or they will drift.
Lineage
Lineage records where data came from and where it goes: source systems, transformations, copies, exports and recipients. It is what lets you answer:
- Access requests. Where is everything we hold about this person?
- Erasure. Every copy we must delete, and every recipient we must tell.
- Rectification. Every downstream copy that still holds the wrong value.
- Breaches. If this system was compromised, whose data, and what kind?
- Transfers. Which flows leave the UK?
Without lineage, each of these is a manual search, and the one-month and 72-hour clocks do not wait.
Metadata that matters for compliance
| Metadata | Use |
|---|---|
| Purpose tags | Enforce purpose limitation in access decisions |
| Personal data flags | Find personal data quickly, including in analytics copies |
| Retention dates | Automate deletion |
| Legal hold flags | Stop deletion when litigation or a request is open |
| Location | Identify restricted transfers |
Start where it pays
Do not try to catalogue everything at once. Start with the systems that hold the most personal data or the most sensitive data, and with the flows to processorsProcessorProcesses personal data on a controller's instructions, such as a cloud host or payroll bureau, with its own security and breach duties. and other controllersControllerDecides why and how personal data is processed. Carries most of the duties, and most of the penalties.. Those are where rights requests and breaches concentrate.
The legal hold point
When a subject access requestSubject access requestPractitioner shorthand for exercising the right of access. Not a statutory phrase, and no particular form or wording is required to make one. is open, deletion that would defeat it risks the s.173 offence. A legal hold flag in the catalogue is a simple control against it.