> Because the data involved information about people I had to write up a document explaining exactly what I was using the data for, exactly what information I w

> Because the data involved information about people I had to write up a document explaining exactly what I was using the data for, exactly what information I would be collecting and why it was necessary, explain where the data was to be stored, and most importantly specify exactly how long I needed the data and when and how it would be safely removed. This just sounds like a design doc, which I do regardless of if it has to get reviewed by a privacy team or I'm doing anything sensitive. Maybe it's because I've worked for mostly google & ex-googler run companies, but this is just standard practice for me.