Count the personal data before you count the licences

Every fast-growing technology company I have worked in has bought software the way it hires: quickly, team by team, with a company card and the best of intentions. Every one of them has later asked its CIO to bring the cost under control. The request usually arrives from finance, framed as a percentage, and the obvious response is a licence review: find the unused seats, cancel the duplicates, negotiate the largest contracts.

I have run that kind of review, and I think it answers the wrong question first. In a company that processes personal data on behalf of others, the first thing a software register should show is where that data goes. The licence count follows from the same work, and in my experience it falls further when the data leads.

What the invoices did not show

In mid-2022, shortly after I became CIO of Amarisca, our software spending had doubled in two years to S$11.6 million. Finance asked for a reduction. We combined three sources that had never been joined: supplier invoices, company card statements and sign-in records from our identity platform. They described 430 separate subscriptions. Invoices alone had shown fewer than half of them.

Sixty-four of those subscriptions held personal data about our employees or our clients' employees without a data-processing agreement. Most were ordinary tools put to ordinary uses. A survey service had collected client employees' questions about their payslips. A free file-transfer site had been used by two teams to send payroll files to clients because our approved route was slow. A transcription tool recorded client calls in which salaries were discussed. None of the people involved had meant to create a risk. Each had solved a problem in front of them.

A licence review would have found almost none of this. The riskiest tools were cheap or free, and a programme driven by cost would have spent its first months on the large contracts. It would also have left us unable to answer the question our clients were starting to ask in audits: in which systems, and in which countries, may our employees' data sit?

A register organised by data, not by department

We rebuilt the register around five classes of data. The first two are our clients' employees' pay data and identity data. The third is our own employees' HR data. The fourth is commercial data with no personal element beyond business contacts, and the fifth is no personal data at all. Each class carries rules. Client pay and identity data may live only in eleven approved systems. Our own HR data may live only in the HR platform and the systems fed from it. Any new tool that would hold personal data needs a security and legal review before it is bought, and company cards can no longer buy software of any kind.

The register records, for each tool, the data class, the countries in which the supplier stores and processes data, whether a data-processing agreement is signed, who owns the tool inside the company and how access is removed when someone leaves. Several of the six countries in which we operate place conditions on sending personal data abroad, and our clients' contracts often add their own. With the register, our counsel can answer those questions from evidence rather than from a survey of managers.

The objections were reasonable. Engineers had chosen their tools carefully and did not want to move. Sales wanted a second prospecting database. I gave way on some of these and not on others. The test I used was the data class, not the seniority of the person asking. A tool holding commercial data could usually stay under an agreement. A tool holding client pay data had to move to an approved system or stop.

The hardest cases now are not new purchases. They are existing tools that add AI features which send content to a further provider for processing. A supplier can make that change in a routine release, and the register can be wrong the next morning. We now require suppliers holding the first three classes of data to notify us before such a change, and our team reviews every release note from those suppliers. It is tedious work, and it is the work that keeps the register true.

Where the savings came from

Over nine months, 42 of the 64 personal-data tools signed agreements and 22 were withdrawn. Subscriptions fell to 214. Annual spending fell to S$8.1 million, a reduction of S$3.5 million.

What surprised me was where the saving came from. We had expected it from cancelling large, underused contracts. Most of it came from duplicates the data mapping exposed. When we asked which tools held each class of data, we found five survey services, four file-transfer tools and three separate note-taking products, each bought by a different team for the same purpose. Consolidating them was easy once the duplication was visible, and the teams themselves often proposed which tool to keep.

There were costs. Two engineering teams lost about a month of productivity moving to approved tools. We deferred S$600,000 of planned automation work to free my team. For the first month we had no quick exception route, and some frustrated colleagues began sharing logins to the tools that remained, which was worse than the problem we were solving. A five-day exception process fixed most of that.

The register has also changed how we leave tools, which matters as much as how we buy them. When a subscription ends, the owner named in the register must confirm that the supplier has deleted or returned our data, and the confirmation is filed with the contract. Before 2022 nobody asked. We found three former suppliers still holding client files years after we had stopped paying them.

For directors, the practical point is this. A software cost report tells you what the company pays. It does not tell you where the company's most sensitive data has gone, and in a business that processes other people's personal data, that is the larger exposure. I would ask management for three numbers: how many systems hold personal data, how many of those operate under a signed agreement, and how long it takes to remove a departing employee's access from all of them. If the answers are slow in coming, the licence savings can wait.