Privacy notices, retention rules and security controls are difficult to maintain when nobody has a reliable picture of the personal information moving through the organisation. A data map creates that shared view.
In this article
Map real activity rather than systems alone
A software inventory tells you which tools the organisation pays for. A data map follows personal information through a business process: where it comes from, why it is used, who can access it, where it goes and when it should be deleted.
Start with processes people recognise, such as recruitment, enquiries, customer delivery, marketing and supplier management.
Capture the facts needed for decisions
| Record | Useful question |
|---|---|
| People and information | Whose data is involved and what categories are used? |
| Purpose and lawful basis | Why is the processing necessary? |
| Location and recipients | Where is data stored and who receives it? |
| Retention and security | When is it deleted and how is it protected? |
Use short conversations with the people doing the work
Policies often describe the intended process; staff can explain the actual one. Short structured interviews reveal spreadsheets, shared mailboxes, exports and manual workarounds that a central systems list misses.
Connect the map to other controls
A useful map supports the record of processing activities, privacy notices, retention schedules, processor contracts, access reviews and data protection impact assessments. Link these records rather than maintaining conflicting copies.
Use the map to identify duplicate collection, excessive access and information retained without a clear purpose.
Give the map an owner and a trigger for review
A data map becomes unreliable when it is treated as a one-off project. Assign ownership and review it when a system, supplier, form, product or purpose changes.
- Has the processing purpose changed?
- Is new personal information collected?
- Has data moved to another supplier or country?
- Do retention and access still match the need?
The map earns its value when teams use it before change, not only after a problem.
English (UK) 
Français 