What is data mapping?
Published 14 min read
A data map is the list of what personal data you hold, where it sits, why, and who else gets it; the GDPR’s Article 30 record is that same list written up one purpose at a time.
A data map, an inventory and a record
Data mapping is the work of finding out what personal data your organisation holds, where it is kept, why you have it, who else receives it and how long it stays. The result is the data map. Nobody wrote a legal definition of it. What the law asks for is the thing you build from it.
Column 1
Whose data, and what
- Employees: contact details
- Employees: sick notes (health data, Art. 9(1))
- Customers: name
- Subscribers: email address
- Job applicants: CV
Column 2
Where it lives
- Payroll bureau portal
- HR shared folder
- Locked paper file
- Web shop
- Accounting software
- Shared mailbox
- Newsletter service
Column 3
Why you hold it
- Pay staff and meet the employer's tax and social-security duties
- Record sick leave and adjust work for health reasons
- Take, deliver and invoice online furniture orders
- Send the monthly newsletter to people who asked for it
- Recruit workshop and office staff
Column 4
Who else gets it
- Payroll bureau (processor)
- tax and social-security authorities
- Payment provider
- courier
- external accountant
- Newsletter service (processor)
Four documents get called a data map, and they answer different readers. Most small firms need the third one and use the first one to build it.
| Document | Organised by | Asked for by | Who reads it |
|---|---|---|---|
| Data inventory | Each system or store: what it holds and about whom | no law names it | IT, and whoever searches for a person's data |
| Data flow diagram | Each movement: from a source, through systems, out to a recipient | no law names it | Whoever checks transfers and vendor contracts |
| Record of processing activities (ROPA) | Each purpose: who, what data, who receives it, transfers, erasure, security | GDPRArt. 30(1) | The supervisory authority, on requestArt. 30(4) |
| California's categories and purposes | Each category of personal information: purpose, sale or sharing, retention | CCPA, spread over several duties§ 1798.100(a); § 1798.130(a)(5)(B); regs § 7152(a) | Consumers, through the notice and policy; the Agency, for risk assessments |
GDPR Art. 30; Cal. Civ. Code §§ 1798.100, 1798.130; CCPA regulations § 7152; read 22 Oct 2026. | |||
“Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility.”
The record has seven items: who you are and how to reach you, the purposes, the categories of people and of data, the recipients, any transfers outside the EU, the time limits for erasure where possible, and a general description of security where possible. A firm that processes data for clients, as a processor, keeps a shorter record of its own under Art. 30(2). Recital 82 gives the reason for both: the record is how you demonstrate compliance, and the supervisory authority can ask to see it to monitor what you do.
Does a 30-person firm need a record?
Article 30(5) lifts the duty from an organisation employing fewer than 250 persons, unless the processing is likely to result in a risk to people’s rights and freedoms, is not occasional, or includes special-category data or data about criminal convictions. Any one of the three brings the duty back.
The Article 29 Working Party, the group of EU regulators that came before the EDPB, read the exemption narrowly in its 2018 position paper on Art. 30(5). A risk means any risk, not just a high one. And its own example is the one that settles it for most firms: a small organisation processes its employees’ data regularly, so that processing is not occasional and goes in the record. The paper also gives small firms something back. The record need only cover the activities that trip one of the three conditions. A truly occasional, low-risk activity can stay out.
Does this activity go in the record? Pick one of the example firm’s activities or answer for your own. Nothing leaves your browser.
Payroll
Goes in the record
Because it is likely to result in a risk to people's rights and it is not occasional. Any one condition is enough (Art. 30(5)).
If you have staff on a payroll and customers in a database, plan on keeping a record. Test each activity on its own: the exemption works line by line, not for the firm as a whole. This is information, not legal advice; where an activity is borderline, ask your adviser.
Worked example: mapping a 30-person furniture maker
The firm is invented but ordinary: a furniture maker in Porto with 30 staff, a workshop, an office and a web shop selling across the EU. Nobody there has a privacy title. The office manager blocks out two afternoons.
Step 1: walk the desks and list every place data lives
Start with systems, not law. The web shop, the accounting software, the shared mailbox, the payroll bureau’s portal, the newsletter service, the HR folder on the shared drive and one locked cabinet of paper. Ask each person which tools they sign into for work; the ones nobody mentions in a meeting turn up here, such as a free form builder someone used for a trade fair.
Step 2: ask each owner six plain questions
The UK regulator’s guidance on documenting processing starts the same way, with an information audit or data-mapping exercise, then a jargon-free questionnaire for each part of the business. Its example questions are the ones to send:
- 1.Why do you use personal data?
- 2.Who do you hold information about?
- 3.What information do you hold about them?
- 4.Who do you share it with?
- 5.How long do you hold it for?
- 6.How do you keep it safe?
Step 3: check the answers against the paperwork
Read the processor contracts, the privacy notice and any retention policy beside the answers. The gap between what the policy says and what people actually do is the most useful thing the exercise finds. Here the shop’s notice promised delivery addresses were deleted after delivery, while the mailbox kept every courier email. The firm set a period it could keep to and wrote it into its retention policy.
Step 4: write it up by purpose
Turn the answers into one row per purpose. That is the Article 30 record. Flip the same rows to group them by system and you have the inventory you search when someone asks for their data. Both views below come from the same 5 rows.
| Purpose(b) | People(c) | Personal data(c) | Recipients(d) | Transfers outside the EU(e) | Time limit for erasure(f) | Security, in general(g) |
|---|---|---|---|---|---|---|
| Pay staff and meet the employer's tax and social-security duties | Employees | contact details, bank account, salary, tax and social-security numbers | Payroll bureau (processor); tax and social-security authorities | None | The periods employment and tax law set, then deleted | Two named managers only; two-step sign-in on the folder |
| Record sick leave and adjust work for health reasons | Employees | sick notes (health data, Art. 9(1)), absence dates | None outside the firm | None | End of employment plus the period employment law sets | Separate locked sub-folder and cabinet; one named reader |
| Take, deliver and invoice online furniture orders | Customers | name, delivery address, email and phone, order history | Payment provider; courier; external accountant | United States (web shop platform's hosting), named in its processor terms | Invoices for the tax-law period; delivery details 12 months after delivery (firm's choice) | Shop admin limited to three staff; card numbers held only by the payment provider |
| Send the monthly newsletter to people who asked for it | Subscribers | email address, first name, opens and clicks | Newsletter service (processor) | United States (newsletter service), named in its processor terms | Removed on unsubscribe; address kept on a do-not-mail list only (firm's choice) | One marketing login; two-step sign-in |
| Recruit workshop and office staff | Job applicants | CV, contact details, interview notes | None outside the firm | None | Six months after the post is filled (firm's choice) | Hiring manager and one HR lead |
Invented firm. Columns: GDPR Art. 30(1)(b)–(g); item (a) heads the record once. read 22 Oct 2026. | ||||||
The trade-fair prize draw collected business cards once, with contact details only. It is occasional, unlikely to result in a risk and holds no special-category data, so the firm left it out of the record and noted why. Everything else is regular, and the sick notes are health data, so they are in.
Do the same in a spreadsheet: one row per purpose, the seven columns above. The data map template lays it out with the Art. 30 items as columns, so you only fill in your own rows.
Link, don't list
The most common weak record is a set of separate lists: every category of person, every category of data, every recipient, with nothing tying them together. It looks complete and answers nothing. The ICO says it plainly: a generic list of pieces of information with no meaningful links between them will not meet the documentation requirements.
People: Employees, Customers, Subscribers, Job applicants
Data: contact details, bank account, salary, tax and social-security numbers, sick notes (health data, Art. 9(1)), absence dates, name …
Which recipient gets the sick notes? The list cannot say.
- Purpose
- Take, deliver and invoice online furniture orders
- People
- Customers
- Data
- name, delivery address, email and phone, order history
- Recipients
- Payment provider; courier; external accountant
The linked row is also the one you can act on. When a customer asks what you hold, you know which systems to search and which recipients to name. When the courier changes, you know which purpose and which notice to update.
Writing purposes a regulator will accept
The purpose column is where most maps go vague, and it is the one both laws lean on. The GDPR requires data to be collected for specified, explicit and legitimate purposes (Art. 5(1)(b)). California’s risk assessment rules go further and name the phrases they will not accept.
“The purpose must not be identified or described in generic terms, such as ‘to improve our services’ or for ‘security purposes.’”
| Generic | Specific | From |
|---|---|---|
| “To improve our services”named as too generic, regs § 7152(a)(1) | Decreasing consumers' wait times when processing their privacy rights requests | The regulation's own example |
| “Security purposes”named as too generic, regs § 7152(a)(1) | Checking new orders for card fraud before the furniture is built and shipped | Example firm |
| “Marketing” | Send the monthly newsletter to people who asked for it | Example firm |
| “HR” | Pay staff and meet the employer's tax and social-security duties | Example firm |
CCPA regulations § 7152(a)(1); GDPR Art. 5(1)(b); read 22 Oct 2026. | ||
A specific purpose does a second job. Once it is written down, you can test each data field against it. The same regulation asks the assessment to record the minimum personal information necessary for the purpose (§ 7152(a)(2)). The newsletter needs an email address and, at most, a first name. If the sign-up form also asks for a phone number, that is a field to stop collecting.
Write each purpose as what you do, for whom, and to what end, in one sentence. If two activities share a sentence, they are probably one purpose; if one sentence hides two outcomes, split the row.
Four answers the map writes for you
A map kept only for the regulator is a cost. The reason to keep it current is that four documents you already owe are built from its columns.
The access reply
Purposes, categories, recipients, storage period and source, about one person. Search the systems view, then copy the person's rows from the record.
GDPR Art. 15(1)(a)–(d), (g); Civ. Code § 1798.110(a)(1)–(4)The privacy policy
Purposes and legal basis, recipients and retention for the GDPR notice; for California, the categories collected in the preceding 12 months, their sources, purposes and recipients.
GDPR Art. 13(1)(c), (e), 13(2)(a); § 1798.130(a)(5)(B)The notice at collection
Each category collected, its purpose, whether it is sold or shared, and how long each category is kept. A map with a retention period per category fills it.
Cal. Civ. Code § 1798.100(a)(1)–(3)The risk assessment
A California risk assessment documents the purpose, categories, sources, retention per category and recipients; a GDPR DPIA opens with a systematic description of the processing and its purposes.
CCPA regs § 7152(a)(1)–(3); GDPR Art. 35(7)(a)Keeping the map true
The record must be in writing, including in electronic form, and shown to the supervisory authority on request (Art. 30(3)–(4)). Nobody files it anywhere. The risk is not a missing filing but a record that describes last year’s firm. The ICO calls it a living document and expects regular reviews.
Five events should send someone back to the map the same week:
| What changed | What to update | Why it matters |
|---|---|---|
| A new app or vendor receives personal data | Recipients, and transfers if it hosts outside the EU | A written contract with each processorGDPR Art. 28(3), 30(1)(d)–(e) |
| A form asks for a new field | Personal data, and the notice | Tell people before collecting a new categoryGDPR Art. 13; § 1798.100(a)(1) |
| Old data is used for something new | A new row with its own purpose | No further use incompatible with the original purposeGDPR Art. 5(1)(b); § 1798.100(a)(1) |
| A retention period changes | Time limit for erasure, and the notice | The notice states the period or its criteriaGDPR Art. 13(2)(a); § 1798.100(a)(3) |
| The person who answered for a system leaves | The owner you would ask next time | no rule; it is how maps go stale |
GDPR Arts 5, 13, 28, 30; Cal. Civ. Code § 1798.100; read 22 Oct 2026. | ||
For a fixed date, borrow California’s. A business the CCPA covers must update the rights and categories in its privacy policy at least once every 12 months. Review the map the week before, so the policy is written from the current one.
Spreadsheet or software? The ICO says documentation can range from basic templates to specialist software, depending on the size of the organisation, the volume of data and how complex the processing is. A firm with a handful of systems is well served by a sheet. Once you have dozens of apps, or answer requests every week, the tools that discover systems for you start to pay; our data mapping software comparison reads them against the Art. 30 items.
Put the five events above in your vendor sign-up routine. When a new tool arrives with a processor contract, the data processing agreement template covers the Art. 28 terms, and the map gets its new recipient the same day.
Data mapping on one card
- What it is
- Finding what personal data you hold, where, why, who gets it and for how long
- What the GDPR names
- A record of processing activities, seven items, one row per purpose (Art. 30(1))
- Fewer than 250 persons
- Exempt only for occasional, low-risk activities without Art. 9(1) or Art. 10 data (Art. 30(5))
- Form
- In writing, including in electronic form; shown to the authority on request (Art. 30(3)–(4))
- Processors
- Keep their own record of processing done for each controller (Art. 30(2))
- California
- No record article; categories, purposes and retention per category go in the notice (§ 1798.100(a))
- Purposes
- Never generic in a California risk assessment (regs § 7152(a)(1))
- Review
- Whenever processing changes; a CCPA privacy policy at least once every 12 months
GDPR, the CCPA and its regulations as posted by the CPPA, read 22 Oct 2026. Information, not legal advice.
Questions
Is a data map the same as a ROPA?
Not quite. The map is the working picture of your data, often grouped by system. The record of processing activities (ROPA) is the document Art. 30 requires, grouped by purpose. Most small firms build the map first and write the record from it.
Do we have to send our record to a regulator?
No. Article 30 asks you to keep it and to make it available to the supervisory authority on request. There is no register to file it with.
We only handle data for our clients. Do we still keep one?
A processor keeps its own, shorter record under Art. 30(2): its name and contacts and those of each client it acts for, the categories of processing done for each, any transfers outside the EU and a general description of security. The Art. 30(5) exemption applies to processors in the same way.
Does the CCPA require a data map?
Not by that name. But the notice at collection, the privacy policy, the answer to a request to know and a risk assessment all ask for categories, purposes, recipients and retention, which is a map in all but name. Our CCPA guide covers which firms the law reaches.
Do paper files belong in the map?
Yes, when they are organised. The GDPR covers manual processing of data that forms part of a filing system (Art. 2(1)), and the CCPA says personal information can exist in physical formats, including paper documents (§ 1798.140(v)(4)). A cabinet of personnel files is a system.
Is a spreadsheet enough?
The law asks for writing, including electronic form, and nothing more about format. The ICO notes that paper documentation may be adequate for very small organisations whose processing rarely changes, though most benefit from keeping it electronically. See the ICO’s documentation guidance.