Data mapping and retention

Every Canadian privacy law assumes you know what personal information you hold. PIPEDA's fair information principles require organizations to limit collection, keep information only as long as needed to fulfil the identified purposes, and protect it with safeguards appropriate to its sensitivity. Quebec's private-sector law, as amended by Law 25, requires governance policies that cover the keeping and destruction of personal information, and requires destruction or anonymization once the purpose has been achieved.

In practice, most organizations we see hold far more than they think. Old employee files sit in a former manager's OneDrive. Scanned driver's licences live in a shared mailbox. A line-of-business database still holds customers from fifteen years ago. When an incident happens, that forgotten data is what turns a contained event into a notifiable breach, and it is what makes an access request take weeks instead of days.

We combine interviews with technical discovery so the map reflects what systems hold, not just what people remember:

1. 01

   Interview the data owners

   Short sessions with finance, HR, operations and client-facing teams to learn what they collect, why, and where they put it.

2. 02

   Inventory the repositories

   Exchange Online mailboxes and shared mailboxes, SharePoint sites, Teams, OneDrive, on-premises file servers, cloud storage, and the business applications that hold customer, patient or employee records.

3. 03

   Scan for sensitive information types

   Use the classification capabilities in Microsoft Purview, where licensed, to locate items containing identifiers such as social insurance numbers, credit card numbers, health numbers and banking details, and review samples to confirm the results.

4. 04

   Trace the flows

   Document where data moves: integrations, exports, email to vendors, and services hosted outside Canada.

5. 05

   Check access

   Record who can reach each repository, including external sharing links and guest accounts.

You receive a working inventory, not a slide deck. For each data category it records:

Retention is a balance. Keep too little and you breach a legal record-keeping duty; keep too much and every incident, lawsuit and access request gets bigger. Some periods come from statute. For example, the Canada Revenue Agency generally requires businesses to keep tax records and supporting documents for six years from the end of the last tax year they relate to. Others come from professional rules, contracts, limitation periods or simple business need.

We draft a retention schedule with your team that names each category, the period, the trigger (such as end of employment or file closure) and the disposal method. Your counsel confirms the legal periods; we make sure each rule can actually be applied in your systems.

A schedule that relies on people remembering to delete things will not be followed. In Microsoft 365 we implement it with Microsoft Purview retention policies and retention labels: policies for broad rules across mailboxes or sites, and labels for specific record types that need a different period or a review before disposal. Content under a retention setting stays in place for users; when it is edited or deleted, Purview keeps a copy (in SharePoint and OneDrive, in the Preservation Hold library) until the period ends.

We test each rule on a pilot location, document the configuration, and make sure retention does not collide with litigation holds. For file servers and line-of-business systems we use the tools those platforms provide, or a scheduled, logged clean-up process where they provide none.

A data map is out of date the day a new app is adopted. We build simple triggers into your processes: a new system or vendor cannot go live until its data category is added to the inventory, and the inventory is reviewed at least annually and after any significant incident. Where you have a managed IT agreement with us, those checks become part of the regular service review.