1. Define the scope.
Identify the application, collection or request task and connected services. Agree a suitable evidence channel and access boundary.
Process
Agree the rule, follow the data and check the result.
Begin with a bounded application workflow and a named decision owner.
2. Map current behavior.
Review where information enters, moves and remains. Mark unknown destinations and ownership gaps instead of assuming the inventory is complete.
3. Confirm approved requirements.
The responsible owner and advisers define the intended consent, preference, retention or request rules. Record exceptions and actions requiring separate authorization.
4. Implement and test safely.
Use isolated records to check the interface, application and connected processing. Do not remove production data or weaken controls as an investigation shortcut.
5. Document evidence and limits.
Record the observed result, unverified systems and maintenance responsibility. Technical checks alone do not establish legal compliance.