What data do I need to consider?

You must consider all personal data including customers, suppliers, contractors and employees. You need to look at how it is collected, stored, shared with others (internally and externally) and how it is being accessed (internally and externally)