Understanding the Template's Purpose
York University recently revealed that personal information from online forms on 14 university websites was accessed by an attacker. This breach involved data submissions from 2007 to 2026, including contact details, government IDs, health information, financial status, and criminal backgrounds.
The key lesson here is about governance. Forms accumulate over time. Departments create them, staff change roles, and the data remains stored long after its purpose has ended. Without clear ownership, these forms are rarely purged.
This template serves as a Legacy Form Inventory and Disposition Register. It provides your team with a record for each form, including an owner, data classification, retention decision, and disposal action. Use it to identify forgotten data collection points, apply a retention rule to each, and demonstrate defensible disposal to regulators.
Getting Started
Before implementing the template, ensure you have the following:
- A list of web properties: Include departmental sites, microsites, and any platforms managed outside central IT.
- Access to form back ends: This includes databases, plugins, email inboxes, and spreadsheets where submissions are stored.
- Your approved retention rules: If unavailable, use the Retention Period column as a placeholder and seek legal approval.
- Any active preservation orders: Disposal must be halted for records under hold.
- A named executive sponsor: Typically the Chief Privacy Officer (CPO) or equivalent. Without this, departments may delay action.
- A data discovery capability: Use a scanning tool or manual method to confirm what data a form collects, beyond the owner's recollection.
The Template
Copy the following into a spreadsheet or your governance platform, with one row per form.
LEGACY FORM INVENTORY AND DISPOSITION REGISTER
SECTION A: IDENTIFICATION
Form ID: [unique ID]
Form name / URL: [full address]
Business owner (named): [person, not a department]
Technical owner: [person or team]
Date form first published: [YYYY-MM-DD or "unknown"]
Last submission received: [YYYY-MM-DD]
Form status: [Active / Dormant / Retired]
SECTION B: DATA COLLECTED
Fields collected: [list every field]
[Data Labeling](/glossary/data-labeling) tier: [Public / Internal / Confidential / [Restricted Data](/glossary/restricted-data)]
Contains government ID: [Y/N]
Contains health information: [Y/N]
Contains financial data: [Y/N]
Contains criminal background: [Y/N]
Contains minors' data: [Y/N]
Third-party data collected: [Y/N; describe, e.g. emergency contacts]
SECTION C: PURPOSE AND LAWFUL BASIS
Original purpose: [one sentence]
Purpose still active: [Y/N]
Lawful basis / authority: [e.g. [Consent](/glossary/consent); [Legal Obligation](/glossary/legal-obligation); [Legitimate Interests](/glossary/legitimate-interests)]
Notice provided at collection:[Y/N; link or version]
SECTION D: STORAGE AND ACCESS
Where submissions are stored: [system, location, region]
Duplicate copies: [email inboxes, exports, backups]
Who has access: [roles, count]
Encryption at rest: [Y/N; method]
Access review last completed: [YYYY-MM-DD]
SECTION E: RETENTION AND DISPOSITION
Applicable Retention Rule: [rule reference]
Retention Period: [e.g. 24 months after submission]
Records older than period: [Y/N; earliest date]
[Preservation Order](/glossary/preservation-order) applies: [Y/N; reference]
Disposition decision: [Retain / [Data Archiving](/glossary/data-archiving) / [Data Purging](/glossary/data-purging) / [Cryptographic Erasure](/glossary/cryptographic-erasure)]
Disposal method: [[Secure Deletion](/glossary/secure-deletion) method used]
Disposal date: [YYYY-MM-DD]
Disposal verified by: [name]
Evidence retained: [certificate, log reference]
SECTION F: BREACH READINESS
Affected-individual lookup possible: [Y/N]
Notification contact fields held: [Y/N]
[Breach Register](/glossary/breach-register) entry (if any): [reference]
SECTION G: SIGN-OFF
Business owner: [name, date]
Privacy / CPO review: [name, date]
Section Functions
A (Identification): Assigns a named owner to prevent forms from becoming orphaned and overlooked.
B (Data Collected): Details what each form gathers. The York incident involved diverse fields, from phone numbers to criminal backgrounds. Your register should reveal this variety before an attacker does.
C (Purpose and Lawful Basis): Connects each form to a documented reason. If the purpose is outdated, the data often lacks justification. Under the Personal Information Protection and Electronic Documents Act, personal information should only be retained as long as necessary. GDPR Article 5(1)(e) mandates the same principle.
D (Storage and Access): Identifies shadow copies. Form data often resides in email inboxes and exports, not just the primary database.
E (Retention and Disposition): Central to the process, this section turns policy into recorded decisions and evidence.
F (Breach Readiness): Ensures you can quickly identify and contact affected individuals. York planned to notify those whose government ID or financial information was exposed, which requires mapping records to people.
Customizing the Template
Adjust classification tiers: Align your Data Labeling scheme to the register. Data with government ID, health, financial, or criminal background should default to Restricted Data.
Set retention periods by form type: Admissions, employment, and health forms often have different retention periods. Align each with your Records Disposition Schedule and statutory minimums. Confirm these with legal advice.
Add jurisdiction fields: If you handle data from EU, UK, or California residents, include a column for the applicable regime: GDPR, UK General Data Protection Regulation, California Consumer Privacy Act or California Privacy Rights Act. Notification duties vary, so record which apply.
Scale the review cadence: Conduct a full inventory annually. Review forms with Restricted Data quarterly.
Prioritize: Start with dormant forms holding Restricted Data, as they pose the greatest risk and offer the least business value.
Validation Steps
Ensure the register's accuracy by testing it.
- Reconcile against discovery: Run Data Discovery across form back ends and compare results with your listed fields. Any missing field in Section B indicates an error.
- Hunt for unlisted forms: Scan your web properties and compare found forms against the register. Gaps reveal unknown departmental sites.
- Sample disposal evidence: Verify that records marked as disposed are removed from primary storage, exports, and backups. Confirm Secure Deletion or Cryptographic Erasure was executed.
- Test the lookup: Select a test individual and ensure you can locate every form they submitted. If not, your breach response will be hindered.
- Check ownership: Contact each named owner. If they don't recognize the form, reassign it.
- Log exceptions: Document reasons for retaining records past their period, such as a Preservation Order. Record it in your Breach Register if it's incident-related.
A form without an owner is a form without defense. Build the register, assign owners, and purge unjustifiable data.
