A Short Framework
The whole method on one page: nine questions, four commitments, and one annual exercise.
Before deciding: nine questions
What specifically are we trying to find out?
The practical test in “A Short Framework” is whether visibility improves a decision without pretending to remove uncertainty. For teams researching does microsoft teams track your activity, this reference page can contribute time and project context, provided the purpose is stated, access is limited and every material inference receives proportionate human review.
What would we do differently with the answer?
For an independent benchmark relevant to “A Short Framework”, consult the FTC data-security guidance. Use it to test necessity, scope, safeguards and review rather than to replace a documented assessment of the particular workforce and jurisdiction.
What is the least we could collect and still answer it?
Who is affected, and what will it be like for them?
What happens when it is used for something else?
When does it end?
What would we say if this were described accurately in public?
Who could have said no to this?
Who decided — by name?
One page. If the first three cannot be answered, nothing else matters.
In the arrangement: four commitments
Say what is not collected, as prominently as what is.
Say who can see individual records, and mean it.
Announce changes before they take effect.
And keep the promises you make, which argues for making fewer.
These four are free, none is legally required, and together they do more for how the arrangement is regarded than any amount of compliance work.
Once a year: one exercise
Every measure listed, with what it is for, when it started, who approved it, and whether the reason still applies.
The question is not whether there is a reason to stop. It is whether there is still a reason to continue.
Half a day. It is the only mechanism that removes anything.
The two tests, held together
Lawful: assessed occasionally, by a regulator, against written rules.
Defensible: assessed continuously, by everybody subject to it, against whether the explanation matches the experience.
The first is necessary. The second determines what the organisation is actually known for, and nobody owns it unless somebody is named.
If you do one thing
Produce the list of everything currently recorded about one person, on one page.
Most organisations cannot, and the exercise of finding out is the single most informative half-day available in this subject.
Then ask the question nobody has asked: looking at this, is it reasonable?
What adopting it actually changes
Fewer proposals rather than better ones. Several do not survive the first three questions, which is the intended effect and the main saving.
Where it sits
Underneath sector-specific requirements rather than instead of them. A framework this short omits a great deal deliberately, on the basis that a page gets used and a manual does not.
What adopting it changes
Produce the list of everything currently recorded about one person, on one page. Most organisations cannot, and finding out is the single most informative half-day available in this subject.
The two tests held together
Lawful, assessed occasionally against written rules. Defensible, assessed continuously by everybody subject to it. The first is necessary; the second determines what the organisation is known for, and nobody owns it unless somebody is named.
Fewer proposals, not better ones
That is the main effect of adopting something like this, and it is the intended one. Several proposals do not survive the first three questions, which is the saving.