Personal data in service desk tickets is handled carelessly

Customers send screenshots, logs, and sometimes copies of documents in their tickets, and engineers paste them into notes and chats. Personal data kept longer or shared wider than needed puts Tidewell IT in breach of its duties as a processor.

Measures

The ticket form asks for the minimum details, and a redaction rule applies to attachments. Tickets older than the retention period are removed automatically, and the Data Protection Officer samples tickets every quarter.