The law on personal data asks an organisation a simple question that is hard to answer: what data do you hold, and where? Most hold more than anyone has written down, in production, in test copies, in file shares and in pipelines. This talk follows the full circle the law asks for. First find the data, wherever it sits. Then judge how sensitive it is. Then decide where it should live and how it should be protected, and keep checking that the answer still holds.
I gave this talk at OpenText Solutions Day in Jakarta in October 2025, the first of my two sessions that day.