Privacy
Data collected & stored about users
How your organization collects, stores, and uses personal data is a legal obligation in most jurisdictions and a trust question in all of them.
Privacy documentation often exists because regulation requires it, but the underlying work is also useful for practical reasons. Knowing what data you hold, where it lives, who can access it, and how long you keep it is the starting point for responding to a data breach, a regulatory inquiry, or a customer asking to see what you hold about them.
For most small organizations the documentation set is manageable: a privacy policy for external use, a record of processing activities for internal use, an assessment of which third parties you share data with, and a clear picture of where personal data is actually stored. The gap is usually not in the policies but in the audit of what data the organization actually holds in practice versus what it thinks it holds.
Data retention is one of the most commonly skipped parts: most organizations collect data indefinitely by default, which creates compliance risk and practical clutter. Deciding what to keep and for how long is a real decision worth making explicitly.