Most privacy programs are documentary. Notices, consent language, contractual clauses, and a data inventory maintained by interview. This pillar studies privacy as an engineered property of running systems, where the claim in the notice can be checked against the behaviour of the data.
The gap between the notice and the system
A privacy notice is a claim about collection, purpose, retention, sharing, and deletion. In most organisations nobody has tested that claim against the systems. Fields are added by product teams, copies accumulate in warehouses and analytics tools, vendors receive exports, and backups hold data long after the stated retention period.
The document is usually accurate about intent and frequently wrong about practice. That gap is not dishonesty. It is the ordinary result of documents being written once and systems changing weekly.
Privacy documents describe collection, purpose, retention, sharing, and deletion. System records show what is collected, where it goes, how long it stays, and whether deletion reaches every copy.
Privacy properties that can be tested
Some privacy promises can become scheduled tests. Others still depend on human judgment or contract. This work sorts one from the other.
| Commitment | Documentary form | Testable form |
|---|---|---|
Data minimisation |
A statement of what is collected |
Field-level inventory from live schemas and logs, compared against the declared set |
Purpose limitation |
A purpose clause |
Access logs showing which services and people read each category, mapped to declared purpose |
Retention |
A published period |
Scheduled queries finding records older than the period in every store, including backups and exports |
Deletion |
A promise on request |
A seeded test subject deleted end to end, then searched for across primary, analytics, backup, and vendor systems |
Third-party sharing |
A vendor list |
Egress monitoring and contract mapping showing where categories actually travel |
Re-identification risk |
An anonymisation assertion |
Linkage testing against available auxiliary data |
Deletion is the sharpest test
Deletion runs into every weakness at once: unknown copies, undocumented vendors, excluded backups, ownerless analytics pipelines, and data derived from the original record. If deletion works across all of them, the organisation probably has a working data map.
This makes deletion verification a possible leading measure of a privacy program. It remains untested. Platform choice may explain the result better than program quality does.
What would prove us wrong?
The pillar assumes engineered privacy reduces harm more than documentary privacy. Several findings would challenge that.
-
Enforcement and harm data showing that actual privacy incidents arise overwhelmingly from access control and breach, not from the collection, retention, and sharing gaps this pillar studies.
-
Evidence that continuous privacy testing produces high false-positive volume that crowds out the incidents that matter.
-
Regulatory outcomes where documentary compliance reliably mitigated penalties regardless of observed data handling.