Tell us about what you do.

This step is one of the final steps in helping understand how your business operates. PORT’s AI will learn how your business operates and identify any potential activities that might require higher scrutiny around your data processing by answering these simple questions. PORT will also use the information you provide to generate your data maps, policies and privacy centre.


In which industry does your business operate?

Teaching PORT about the industry you operate in will help PORT’s AI better predict your industry’s data processes, providing you with a more accurate data map and use of terminology in your policies and privacy centre.


What do you call your customers?

This is simply the term you use to describe your customers. The term will be used to define individuals on your data map, policies and in the privacy centre. 

Many businesses will just define customers as customers. However, some professions such as schools and doctors may prefer to define their customers as “students”, “parents”, and “patients”.  In some cases, such as a school, you may also need to record two types of customers like “parents” and “students”. 



Where possible, try and keep things simple. Only use more than one definition of your customers if you have to. Ultimately it comes down to your data processes. If you are processing data very differently depending on the types of individuals, such as the student/teacher example sighted, you will need multiple categories of individuals. If you do not treat each type differently, then you likely won't need multiple descriptions. 

What do you call your potential customers/leads?

These are the people you are trying to sell to. It’s common practice to collect lead data in some way or another. The data might be phone numbers on your phone, signups on a mailing list or CRM, or inbound enquiries. In whatever format they exist, if you are keeping them to use them to try and sell to in the future, you are processing data on them, and these processes will need to be recorded.

Simply select a field that fits best for your business. 


If you do not process data in this way, just select the default field, and then go ahead and remove any associated data processes from your data map once it has been generated in the next step.

Are any of the individuals you deal with children?

Children require specific protection regarding their data as they may be less aware of the risks, consequences, and safeguards concerning their rights to their personal data processing. Such specific protection should, in particular, apply to the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of personal data about children when using services offered directly to a child. This question allows to identify these processes and apply the appropriate scrutiny and legal basis. 


Do your customers or other individuals visit where your business operates from?

A common practice for businesses with visitors is to keep a visitor log. A visitor log in itself is a form of processing, which PORT needs to identify. 


Do you operate a CCTV?

CCTV is also a commonly used method of data collection and processing for business and comes with its own specific regulatory requirements due to its use of biometric data.

In general, CCTV is directed at viewing and/or recording the activities of individuals. Therefore, most uses of CCTV by organisations or businesses will be covered by the GDPR and the Data Protection Act 2018. The ICO has issued a code of practice that provides recommendations on the use of CCTV systems to help organisations comply with the Data Protection Act.