Lesson 3: Handling Harbourline's data so Viktor can defend it
17 min read·13 Oct 2026
Module 4 · Lesson 3 · About 50 minutes · Needs: Lesson 1 of this module (the access requests, the S3 bucket); basic Python
The situation
Wednesday 1 April 2026, week 3. The TMS export was easy: it holds no personal data. The claims inbox is different. Rafael forwards four sample emails, and the first, MSG-3101, is from Dana Price at Northgate about late shipment HF-88102, with her mobile number in the signature.
Viktor Hale will not open the inbox until you answer three questions: what personal data you take, where it goes, and how long you keep it. This lesson answers them, plus one he did not ask: what the contract lets you do. Legal facts come from the regulators' own pages, dated; this is not legal advice.