Collect deliberately
List every field and event, including logs and analytics. Record the user-facing explanation and owner for the collection decision.
Data trail
Draw a data route that survives the demo.
A field on a screen can lead to identity services, analytics, email, support tools, hosting, backups, and human exports. The Estonia data trail names those paths before implementation and checks them again before release.
Limit the working set
Define which roles and vendors need each category, how access is granted, and how it is removed.
Trace processors and regions
Map hosting, backups, integrations, support access, and transfers instead of relying on the location of the primary server alone.
Design the exit
Assign retention, correction, export, deletion, incident, and rights-response procedures with evidence that the action completed.
IDENTITYTreat identifiers as scoped data
Do not collect registry, personal, or authentication details because an integration makes them available. Match the minimum identifier to the actual user task.
ANALYTICSMeasurement belongs on the same map
Document tags, cookies or local storage, events, destinations, consent choices, and retention. A marketing tool is still part of the product’s data route.
AI INPUTSKeep model boundaries explicit
Identify what may enter an AI service, what must be redacted, whether outputs are stored, and who reviews the result before it affects a person.
RELEASERecheck the implemented path
Inspect production requests, access, logs, exports, and user controls. A diagram passes only when the deployed behavior matches it.