FieldRegister
Every field · Behaviour, engagement and scoring

Calls, meetings, emails logged (activity records)

Activity history is a running record of what a person said and did; it grows without bound and is disclosable on an access request.

personal data
personal data?
standard
sensitivity
needs a basis
AI use
legitimate interest
lawful basis usually relied on

Keep it how long

With the relationship; purge logged emails on a schedule.

The gap we see most

Years of logged emails with third parties copied in, all disclosable under Art. 15.

What holding it is evidence for

Requirement text and artefacts from a human-verified corpus licensed to Field Register.

Free text and attachments GDPR Art.5 · GDPR Art.15 · ISO/IEC 27701:2019 7.4.1 · ISO/IEC 27701:2019 7.4.7
GDPR Art.5 Principles relating to processing of personal data

Process personal data lawfully, fairly and in a transparent manner; collect it for specified, explicit and legitimate purposes and do not process it further in a way incompatible with those purposes; keep it adequate, relevant and limited to what the purpose needs; keep it accurate and up to date, e...

Evidence an auditor accepts: The purpose recorded for each processing activity, stated specifically enough that a later use can be tested against it; Retention schedule per data category with the criteria that set each period, and deletion evidence showing the schedule actually runs; Minimisation analysis per collection point showing why each field is necessary for the stated purpose
GDPR Art.15 Right of access by the data subject

On request, confirm whether personal data concerning the data subject is being processed and, where it is, provide access to that data together with the purposes, the categories of personal data, the recipients or categories of recipient including any in third countries or international organisation...

Evidence an auditor accepts: The search methodology showing every system, archive and unstructured store searched, and how completeness was assured; A worked response covering all the supplementary information items, not only the copy of the data; The redaction position and the applied redaction log where third party data was withheld, with a reason recorded per redaction
ISO/IEC 27701:2019 7.4.1 Limit collection

The organization must limit collection of personal data to the minimum that is adequate, relevant, proportional and necessary for the identified purposes, including data collected indirectly through means such as web and system logs, and where any optionality in collection and processing exists each...

Evidence an auditor accepts: Field level justification linking each item collected to an identified purpose; Assessment of indirectly collected data such as logs, telemetry and tracking; Evidence optional collection is off by default, captured from the live configuration
ISO/IEC 27701:2019 7.4.7 Retention

The organization must not retain personal data longer than the purposes for which it is processed require, developing and maintaining retention schedules that take account of legal, regulatory and business requirements and, where those requirements conflict, taking and documenting a business decisio...

Evidence an auditor accepts: Retention schedule covering every category of personal data, with the period and its justification; Evidence the schedule is enforced, not merely published; Documented risk based decisions where legal, regulatory and business requirements conflicted

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Dates and timestamps (created, modified, last contacted) · Lead source or campaign attribution