If you've mapped your data governance programme against the NDPR and the NDPA, you've likely inventoried your customer database, your CRM, and your internal HR records as the places personal data lives. Fewer programmes extend that same discipline to the photos, scanned documents, and PDFs the business shares every day — even though those files routinely carry personal data of their own, embedded as metadata.
The obligation most programmes miss
A product photo, a signed contract scan, or a marketing PDF looks like ordinary business content. But its metadata can contain GPS coordinates, device identifiers, and the real name of whoever created it — all of which qualifies as personal data under the same framework that governs your customer records. A governance programme that only maps structured databases has a blind spot exactly here.
Why this is a real NDPR/NDPA exposure
- Transparency — you cannot honestly tell people what personal data you process if you don't know what's embedded in the files you distribute.
- Security — unstripped metadata in files sent to third parties can leak internal staff identities and device details outside your control.
- Data minimisation — there is rarely a legitimate business reason to retain author names or device identifiers on a public-facing file, which puts them at odds with the minimisation principle by default.
A practical fix
- Inventory the file types your business regularly shares externally — marketing assets, contracts, reports, scanned documents.
- Add a metadata-review step to your publishing workflow before any file leaves the organisation, not as a one-off cleanup exercise.
- Spot-check periodically rather than assuming a policy is being followed in practice — examiners test whether controls actually operate, not just whether they're written down.
- Where the volume is too high to check manually, this is exactly the kind of control worth automating or outsourcing rather than skipping.
Not sure where your business stands?
Book a free consultation and we'll map your specific obligations, tell you what's urgent, and give you a clear plan.