When we think « personal data », we think of names and email addresses. The GDPR covers far more than that, and some of this data sits in places nobody thinks to look at before an export or an AI call.
What counts as personal data
Data is personal as soon as it makes it possible to identify a person, directly or by cross-referencing it with something else. That goes well beyond civil status details.
| Category |
Examples in TimeTonic |
| Direct identifiers |
Surname, first name, email address, phone number, postal address, client number. |
| Technical data |
IP addresses, share URLs, session identifiers, device identifiers. |
| Activity traces |
Change histories, timestamps, who created or modified which row. |
| Free text content |
Comments, descriptions, notes, SmartText: any field where somebody may have written a name or a situation. |
The blind spots
The last two categories in the table are the ones that cause problems, because you do not see them when you look at your table.
The free text field filled in by a human
A « Comment » or « Notes » column has no imposed format. It ends up containing people's names, reasons for absence, appraisals. These are often the most sensitive data in the table, and the least controlled.
→ Choosing the right level of protection
The change history
It keeps the trace of who changed what, and when. It is data about your colleagues as much as about your clients, and it is visible from the record. See the next section.
Attachments
A PDF or a photo carries its own content, and sometimes its metadata. A shared attachment is not filtered by the columns you chose to expose.
→ Attachments · Check your external sharing
Link columns
From a record, a link column opens the records of another table. If no view is selected on it, it exposes far more than you had planned, including in an export or a share.
→ View selection on a link column
Share URLs
The URL of a shared view is itself data to be protected: it opens an access. It has no place in an export, a ticket or a screenshot.
→ Revoke an access
The Changes panel: what it actually exposes
Every record has a Changes tab, next to the comments. It is not a technical log reserved for administrators: it can be read by anyone who opens the record, and it says a great deal.
| What can be read there |
Why it matters |
| The old and the new value |
Data that has been corrected or erased remains readable in the history. An emptied field is not deleted data. |
| The name of the modified field |
Even if the column is invisible in the view today, its name and its past values appear here. |
| The author and the timestamp |
This is personal data about your colleagues: who worked on what, and at what time. |
| The origin of the modification |
The mention « via TimeTonic automations » reveals that an automation is acting on that row. |
A correction does not make the original value disappear. If sensitive data was entered by mistake in the wrong field, correcting it is not enough: the old value remains readable in the history of the record. Bear this in mind when handling an erasure request.
Learn more → Change history · Last modified · Notifications for comment and history columns
Four moments when you have to check
1
Before an export
An export takes away the columns of the view, including the ones you had forgotten to remove from it.
2
Before connecting an automation
Make, n8n, Zapier, an outgoing webhook: every call takes away what you give it. Ask yourself the question column by column, not table by table.
3
Before an AI call
An
Ask AI action sends the content of the field to the chosen model. Pass it only the field to be processed, not the whole row, and check which AI source is selected.
4
Before a demonstration or a screen capture
A demonstration video filmed on real data broadcasts everything that is on screen, share URLs and the Changes panel included. Use a test data set.
The habit to build: the dedicated export view
Rather than sharing a whole table and then removing what is a problem, create a view dedicated to each destination, containing only the columns useful to that destination.
One view per integration, one view per partner, one view per recurring export: in the Field restrictions window, set everything else to Invisible, then lock the view settings.
The detailed procedure → Choosing the right level of protection · Lock the options of a view
This is the principle of privacy by default: the most protective configuration is the one that applies by default, and you then open up case by case. The opposite, opening up and then restricting, always leaves columns behind.
Go further
Your GDPR obligations
The register, access requests and who to contact.
Read more →
Go further
Change history
What the Changes panel keeps and displays.
Read more →
Go further
Encrypt, mask or restrict
The right mechanism for each sensitive value.
Read more →