GDPR Q40
How do I conduct a data mapping exercise?
Q40. How do I conduct a data mapping exercise?
Category: Assessments
Data mapping shows where personal data flows in your organisation. It is the foundation for RoPAs, DPIAs, and risk assessments.
In simple terms
- Identify data sources, destinations, and storage locations.
- Understand purposes, lawful bases, and retention.
- Use mapping to uncover risks and improvement opportunities.
Planning the exercise
Decide the scope (e.g., a department or system) and gather stakeholders who understand processes.
- Use interviews, workshops, and system audits to collect information.
- Map both digital and paper-based processes.
- Include third-party transfers and international flows.
Documenting findings
Record data categories, lawful bases, recipients, security measures, and retention periods.
- Visual diagrams help identify gaps or unnecessary duplication.
- Link mapping outputs to your RoPA and DPIAs.
- Set review dates to keep maps current.
Practical steps to take
- Set objectives and choose mapping tools or templates.
- Gather information from process owners and IT teams.
- Create flow diagrams or tables showing each processing step.
- Validate findings with stakeholders and correct inaccuracies.
- Integrate mapping insights into risk management and compliance reports.
Real-life examples
Customer journey map
A retailer maps personal data from website forms to CRM, fulfilment, and marketing platforms.
Employee lifecycle map
HR teams map data from recruitment to offboarding, identifying redundant copies and improving deletion routines.
Helpful reminders
- Include unstructured data such as shared drives and email.
- Update maps when systems or suppliers change.
- Use mapping to support DPIAs and breach investigations.
Key takeaway
Accurate data maps reveal how information moves—use them to spot risks and prove compliance.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.