IOT-31Recommended
List every sensor and every field that leaves the device
Keep one file per model that lists each sensor and each field the device sends, with its purpose and retention. The build fails when the firmware sends a field the file does not list.
How to do it
Sensors collect more than their name suggests. A motion sensor shows when a home is empty, and power readings show when people wake up. Publish the sensor list to buyers, as ETSI EN 303 645 provision 5.8-3 asks. Feed the field list into your data map, and keep each field only as long as delete old data automatically sets. In the EU, the same list answers the pre-sale facts in give users the data from connected products.
Examples
YAML example
model: thermostat-t2
sensors: [temperature, humidity, motion]
fields:
- name: temperature_c
purpose: heating control and history
retention: 24 months
- name: occupied
purpose: away mode
retention: 30 days
How to check
A build step compares the telemetry schema with the model's field list and fails on any field without a purpose and a retention period. The product page lists every sensor in the file.
Sources
Related rules
- CMP-7 Map every store that holds personal data in Compliance and governance
- DAT-31 Delete old data automatically in Data and databases
- CMP-54 Give users the data from connected products in Compliance and governance
- IOT-33 Round location to what the feature needs in Connected devices
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/connected-devices/sensor-data-and-privacy/sensor-inventory">Agent Wranglers connected devices playbook</a>. In code you write, add a comment next to it with the same link.