Zero Security Theatre
Patterns and anti-patterns
Patterns are practices that help when tested. Anti-patterns are common, usually well-intentioned practices that create paperwork without improving the result.
Anti-patterns
Treating the privacy notice as a description of the systems
The notice states intent. Field inventories, access logs, retention queries, and deletion tests state practice. Where they disagree, the systems are the fact.