What the evidence says
Not every energy value is personal data, but user accounts, logs and linked identifiers may be.
Cyber-physical availability remains important even where personal-data rules are not triggered.
What a business should do next
- Map data flows, roles, cloud locations, retention and remote privileges.
- Contract for revocation, export, deletion, local fallback and incident support.