The backlog links each data operation to a purpose, responsible owner, approved basis or instruction, system, vendor, access role, retention rule, user communication, and validation method. Faith Forge Labs implements the approved controls without certifying legal compliance.
Prepare the project briefMap what data enters, the user action that creates it, the purpose, whether it is necessary, who decides, who processes, who can access it, where copies appear, and when they are removed. Forms, analytics, session replay, advertising, support, identity, AI, and logs belong in the same map.
A banner alone does not describe what the browser loads. Inventory scripts, requests, cookies, local storage, pixels, embeds, and server-side events. Classify the actual purpose and configuration, then have the responsible reviewer decide consent or exemption. Test that the chosen behavior follows the decision before and after preference changes.
If the approved model requires access, correction, deletion, objection, portability, or another request path, define identity verification, search scope, exceptions, export format, response owner, and audit evidence. Incident handling needs detection, containment, contact, decision, and recovery owners rather than a privacy-page promise.
List the fields, events, vendors, copies, countries, access roles, retention rules, user notices, and unresolved decisions that apply to the current system.
Prepare the project brief