Agent WranglersPersonal data
Store as little personal data as the job needs, delete it on a schedule and on request, and keep it out of test copies. Know who read it and when.
- Required 4
- Recommended 1
Required
Store only the personal data you need
RequiredAdd a personal data column only when a feature needs it, and write down why. GDPR Article 5 asks for data that is limited to its purpose.
Delete old data automatically
RequiredGive each kind of personal data a retention period, and let a scheduled job delete or anonymise rows when it ends.
Keep personal data out of test copies
RequiredNever copy personal data into development, test or staging databases. Mask or replace it while copying.
Log who reads personal data
RequiredRecord when staff or support tools read or change a person's data, so misuse can be found and proved.
Recommended
Encrypt the most sensitive fields
RecommendedEncrypt fields whose leak would cause serious harm, such as ID numbers or health data, in the app before they reach the database.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers data playbook: https://agentwranglers.se/playbook/data/personal-data.