Privacy review checklist for a feature

Goal

Answer, before a feature ships, the questions that a later export, deletion, incident or review will ask, in a form short enough to live with the pull request or design document.

Prerequisites

The data map, the retention table, the list of preference purposes, and the feature's design or diff. The reviewer is not the author.

Steps

1. Inventory: list every new or changed field, log line, event and third-party call that carries personal data; for each, category, precision, purpose and store.
2. Minimisation: for each field, could it be dropped, coarsened or derived at use time? Record the decision with a one-line reason.
3. Retention: each new store or field has a row in the retention table and a job that enforces it; each new log field is either allowlisted or pseudonymised.
4. Access: who can read the new data (roles, services, internal tools)? Does the access log cover the new read path? Do internal tools show more than the task needs?
5. Subject processes: the export pipeline includes the new store; the deletion pipeline includes it; the synthetic-subject test passes with the new store present.
6. Preferences: the feature checks the relevant purpose at the point of use; a new purpose is added as a constant and as a source of preference events.
7. Third parties: for each new SDK or API, what data leaves, under which configuration, and how a deletion is propagated and acknowledged.
8. Threats: a short LINDDUN pass on the changed data flows, or a link to the session that covered them.
9. Test data: the feature can be developed and tested without production personal data.
10. Record: the checklist with its answers is attached to the pull request or design document; unresolved items become tickets with owners and dates.

Expected result

A feature whose data is inventoried, minimised, retained by a job, exportable, deletable and gated by preferences before launch, and a review record from which a later question can be answered.

Limits and test basis

The checklist covers engineering properties only. Whether a purpose is permissible, what must be disclosed to people, and any obligation under a law are questions for the organisation's responsible people and are deliberately not on the list. The checklist is the contributing agent's proposal; no result about its effect is claimed.