When we think « personal data », we think of names and email addresses. The GDPR covers far more than that, and some of this data sits in places nobody thinks to look at before an export or an AI call.
Contents
- 1. What counts as personal data?
- 2. Where are the blind spots?
- 3. What does the Changes panel actually expose?
- 4. When do you have to check?
- 5. Which habit should you build for each export?
1. What counts as personal data?
Data is personal as soon as it makes it possible to identify a person, directly or by cross-referencing it with something else. That goes well beyond civil status details.
| Category |
Examples in TimeTonic |
| Direct identifiers |
Surname, first name, email address, phone number, postal address, client number. |
| Technical data |
IP addresses, share URLs, session identifiers, device identifiers. |
| Activity traces |
Change histories, timestamps, who created or modified which row. |
| Free text content |
Comments, descriptions, notes, SmartText: any field where somebody may have written a name or a situation. |
2. Where are the blind spots?
The last two categories in the table are the ones that cause problems, because you do not see them when you look at your table.
The free text field filled in by a human
A « Comment » or « Notes » column has no imposed format. It ends up containing people's names, reasons for absence, appraisals. These are often the most sensitive data in the table, and the least controlled.
→ Choosing the right level of protection
The change history
It keeps the trace of who changed what, and when. It is data about your colleagues as much as about your clients, and it is visible from the record. See the next section.
Attachments
A PDF or a photo carries its own content, and sometimes its metadata. A shared attachment is not filtered by the columns you chose to expose.
→ Attachments · Check your external sharing
Link columns
From a record, a link column opens the records of another table. If no view is selected on it, it exposes far more than you had planned, including in an export or a share.
→ View selection on a link column
Formulas that copy personal data
A formula does not inherit the GDPR / confidential marking of the fields it reads. A label that combines a name and an email therefore goes into the export. Mark it Sensitive by hand.
→ GDPR / confidential marking: mark a field
Share URLs
The URL of a shared view is itself data to be protected: it opens an access. It has no place in an export, a ticket or a screenshot.
→ Revoke an access
3. What does the Changes panel actually expose?
Every record has a Changes tab, next to the comments. It is not a technical log reserved for administrators: it can be read by anyone who opens the record, and it says a great deal.
| What can be read there |
Why it matters |
| The old and the new value |
Data that has been corrected or erased remains readable in the history. An emptied field is not deleted data. |
| The name of the modified field |
Even if the column is invisible in the view today, its name and its past values appear here. |
| The author and the timestamp |
This is personal data about your colleagues: who worked on what, and at what time. |
| The origin of the modification |
The mention « via TimeTonic automations » reveals that an automation is acting on that row. |
A correction does not make the original value disappear. If sensitive data was entered by mistake in the wrong field, correcting it is not enough: the old value remains readable in the history of the record. Bear this in mind when handling an erasure request.
Learn more → Change history · Last modified · Notifications for comment and history columns
4. When do you have to check?
1
Before an export
An export takes away the columns of the view, including the ones you had forgotten to remove from it. Mark personal data with the GDPR / confidential marking option. FTP / SFTP and Metabase exports exclude it by default. The manual CSV export does not remove it on its own.
2
Before connecting an automation
Make, n8n, Zapier, an outgoing webhook: every call takes away what you give it. Ask yourself the question column by column, not table by table.
3
Before an AI call
An
Ask AI action sends the content of the field to the chosen model. Pass it only the field to be processed, not the whole row, and check which AI source is selected.
4
Before a demonstration or a screen capture
A demonstration video filmed on real data broadcasts everything that is on screen, share URLs and the Changes panel included. Use a test data set.
5. Which habit should you build for each export?
Rather than sharing a whole table and then removing what is a problem, create a view dedicated to each destination, containing only the columns useful to that destination.
One view per integration, one view per partner, one view per recurring export: in the Field restrictions window, set everything else to Invisible, then lock the view settings.
The detailed procedure → Choosing the right level of protection · Lock the options of a view
For FTP / SFTP and Metabase exports, add marking to the dedicated view. A field marked Sensitive stays out of the file, even if it is added to the view later.
Marking step by step → GDPR / confidential marking: mark a field · Exclude fields from an export: sensitive data and GDPR
This is the principle of privacy by default: the most protective configuration is the one that applies by default, and you then open up case by case. The opposite, opening up and then restricting, always leaves columns behind.
Go further
Your GDPR obligations
The register, access requests and who to contact.
Read more →
Go further
Change history
What the Changes panel keeps and displays.
Read more →
Go further
Encrypt, mask or restrict
The right mechanism for each sensitive value.
Read more →