Keeping data secure begins with knowing what you have, why you have it and who is responsible for it. Buying a security product does not answer those questions.
For a business unit, I would start with one workflow. Follow a document from its collection through storage, use, sharing and eventual disposal. Include the exports, email attachments, backups and copies made for an AI tool. Each copy is another place to account for.
Three things to protect
The existing security introduction explains three useful questions: who may see the information, whether it can be trusted, and whether authorised people can obtain it when needed.
Here is an invented supplier-renewal process:
- A private price list sent to the wrong recipient is a confidentiality problem.
- A renewal date changed incorrectly is an integrity problem.
- A team unable to reach the approved renewal register when it needs it has an availability problem.
All three matter. A file can be encrypted and still contain the wrong price or be unavailable when the team needs it.
Make a small data map
My proposed starting record looks like this. Every item below is fictional:
| Information | Purpose | Who needs it? | Question for the owner |
|---|---|---|---|
| Approved supplier terms | Prepare renewals | Named procurement reviewers | Where is the approved version? |
| Renewal dates | Plan decisions | Procurement and budget owner | Who can correct a date? |
| Draft comparison | Consider alternatives | Review group | Which sharing route is approved? |
| Exported copy | Support one review | Assigned analyst | When should this copy be removed? |
| Recovery copy | Restore the register | Authorised support team | When was recovery last demonstrated? |
Use your organisation's classification labels. A label such as “confidential” needs an actual rule about storage, recipients and permitted tools. It does not enforce those rules by itself.
Keep what the purpose needs
Ask which fields the job really needs. A renewal briefing may need contract dates and approved terms without needing unrelated contact details or payment information.
For UK personal data, the ICO's data-minimisation guidance explains that information should be sufficient, relevant and limited to the purpose. Its storage-limitation guidance does not prescribe one universal retention period. The right period depends on the purpose and applicable obligations. Ask the responsible owner about your records; do not delete business evidence on an AI's suggestion.
Protect the journey and the copies
Use approved encrypted connections and storage. Ask who controls the encryption keys and who can access readable information. OWASP's cryptographic-storage guidance explains why key management matters. Encryption does not correct an overly broad sharing link or stop an authorised recipient copying what they can read.
Passwords, API keys and other credentials belong in approved secure storage, not in briefing documents or AI prompts. If a credential is exposed, tell the responsible team: OWASP's secrets guidance explains revocation and replacement as part of managing secrets. Merely hiding the message does not establish that access has ended.
For recovery, the NCSC's backup guidance explains keeping copies protected from incidents affecting the original. A synchronised deletion can affect a working copy too; do not assume sync is your entire recovery arrangement.
I would ask the technical owner to demonstrate a restore into a safe test location: which copy was recovered, how old was it, and could an authorised person actually use it? This is a proposed evidence check, not an instruction to overwrite production or a guarantee that a backup service meets your needs.
Ask your AI to teach you
Use an approved, disconnected learning chat. The prompt is not a technical security control. Keep the exercise fictional even if the assistant asks for a real file to make its answer more specific.
Check that you can use it
Pick one fictional record and explain who needs it, where approved copies would live, how a correction would be controlled and how recovery would be checked. Then identify one field that is unnecessary for its purpose.
For your actual work, arrange a discussion with the business owner and the responsible IT or privacy team. A useful outcome is an agreed data map with named questions to resolve, not an AI-issued “secure” badge.
Revisit authorisation, databases or file types where you need a clearer foundation.
Sources and boundaries
Sources checked on 21 October 2026. The ICO pages state that guidance is under review following the Data (Use and Access) Act. This lesson uses their general principles, gives no fixed retention period and is not a legal assessment. OWASP and NCSC support the technical foundations. The map, checks and exercises are proposed practice, not a completed security audit or a validated training programme.