Data mapping software
For a firm building its first data inventory, from a spreadsheet or from nothing. 7 data mapping tools, from automated discovery to questionnaire-led registers, measured against what a GDPR Article 30 record and a US state risk assessment must hold, from each vendor’s own pages. read 2026-10-22
Best overall
Ketch
Field-level discovery, retention terms read from contracts, transfers flagged and the CCPA risk assessment fed from one map. Data mapping is on its quoted Pro tier.
Best for a firm that is also a processor
TrustArc
Article 30 reports for both controller and processor, with purposes, legal bases and retention pre-filled for your review.
Best for a firm moving off a spreadsheet
GDPR Register
A field for every Article 30 item and Excel import; reading your apps from Microsoft 365 or Google Workspace is on its top plan.
The record's requirements, tool by tool
Each row is something the Article 30 record, an impact assessment or a request asks of your inventory, with the article or section beside it. Columns run from discovery-led tools on the left to the register you fill in yourself on the right. If you have no inventory at all yet, list your systems in the data map template first: it makes every demo shorter.
| Requirement | Ketch | DataGrail | MineOS | OneTrust | Osano | TrustArc | GDPR Register |
|---|---|---|---|---|---|---|---|
| Finds the systems you run without a surveyevery activity in the Art. 30(1) record | yesconnectors and agents | yesalerts on new apps | yesSSO and email scan | yesIAM, cloud, CMDB | yesSSO and other sources | yesvia integrations | paid planMicrosoft or Google apps |
| Finds personal data inside those systemsArt. 30(1)(c) categories of personal data | yesdown to the field | yes | yescloud scan or sampling | yes | yesfield discovery | partialthrough partner tools | not statedfinds connected apps only |
| Records the purpose of each activityArt. 30(1)(b) | not statedactivities listed | not statedsuggests activities | yesAI suggests, you accept | not stated | not stated | yespre-filled for review | yes |
| Records how long each category is keptArt. 30(1)(f) | yesread from contracts | not stated | not stated | not stated | partialretention rules via labels | yes | yes |
| Flags transfers outside the EUArt. 30(1)(e) | yes | not stated | not stated | yes | yes | yes | yesSCCs and DPF tracked |
| Builds the record of processing activitiesArt. 30(1)-(3) | yes | yes | yes | yes | yes | yescontroller and processor | yes |
| Exports the record to hand a regulatorArt. 30(4) | yes | yesCSV or PDF | yesCSV | not stated | not stated | yesconfigurable exports | yesone-click reports |
| Feeds an impact or risk assessmentArt. 35(7)(a); CCPA regs § 7152; Va. § 59.1-580 | yesincl. CCPA risk assessment | yes | yesDPIA reports | yes | yespre-fills questionnaires | yes | paid planDPIA workflow |
| Uses the map to answer a person's requestArt. 15(1); Cal. Civ. Code § 1798.110(a) | yes | not statedrequest tool sold beside it | yes | yesin its DSR product | yesin its rights module | not stated | not statedlogs requests, no data search |
Source: vendor documentation, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | |||||||
What a scan can find, and what only people can tell you
Every tool on this page sells some mix of two methods. Automated discovery connects to your systems and reads what is there. A questionnaire asks the person who runs each process to describe it. The record the GDPR asks for needs both, because half of its items are facts about your data and half are decisions about it. The table walks the seven items of Art. 30(1) and shows where each answer really comes from. Our guide to what data mapping is works the same items through a small firm’s example.
| What the record must hold | Where the answer comes from | Asked again by |
|---|---|---|
| Who you are: controller, representative, DPOArt. 30(1)(a) | you, onceTyped in when the record is set up; it changes only when people change. | not asked again |
| The purpose of each activityArt. 30(1)(b) | a personThe team that runs the process. A scan sees data, never the reason you hold it. | The access answer; the California right to know; the risk assessmentArt. 15(1)(a); § 1798.110(a)(3); regs § 7152(a)(1) |
| Categories of people and of personal dataArt. 30(1)(c) | a scan, then a personField discovery labels columns; someone confirms whose data each table holds. | The same threeArt. 15(1)(b); § 1798.110(a)(1); regs § 7152(a)(2) |
| Who receives the dataArt. 30(1)(d) | discovery and contractsConnected apps show most vendors; the contract says what each one receives. | The same threeArt. 15(1)(c); § 1798.110(a)(4); regs § 7152(a)(3)(F) |
| Transfers to a country outside the EU, where applicableArt. 30(1)(e) | contracts and hostingThe vendor's hosting regions and its transfer terms; some tools flag the flow. | The access answerArt. 15(1)(c) |
| How long each category is kept, where possibleArt. 30(1)(f) | a decisionYour retention policy. A vendor contract can tell you its own deletion terms, not yours. | The access answer; the risk assessmentArt. 15(1)(d); regs § 7152(a)(3)(B) |
| A general description of security measures, where possibleArt. 30(1)(g) | IT and vendorsYour own controls and each vendor's security documents. | not asked again |
Source: GDPR Art. 15 and 30, Cal. Civ. Code § 1798.110, CCPA regulations § 7152, read 2026-10-22. | ||
The last column is the reason a map pays for itself. An access request asks for the purposes, categories, recipients and storage period: the record’s own items, about one person. A California risk assessment asks for them again, and the regulations rule out the easy answer.
“The purpose must not be identified or described in generic terms, such as ‘to improve our services’ or for ‘security purposes.’”
A tool that says it builds the record from discovery alone is describing the data columns. Purposes and retention periods still come from people, which is why the purpose and retention rows in the table above are thinner than the discovery rows. Set your retention periods first with the retention policy template; then any tool has something true to record. The full text of Article 30 is short enough to read before a demo.
Do you need a record, and what the US laws ask instead
Under the GDPR
Article 30(5) lifts the record duty from an organisation employing fewer than 250 persons, but only if none of three things is true: the processing is likely to result in a risk to people’s rights and freedoms, it is not occasional, or it includes special-category data or data on criminal convictions.
The middle condition is the one small firms trip on. Payroll, a customer database and a mailing list run every week, and nothing in the text treats regular processing as occasional. Read the exemption narrowly and check it with your adviser before you rely on it.
Under the California law and the other states
The CCPA has no record-of-processing article. It asks for the same facts in three other places, and each one is easier with a map:
- The right to know: on a verified request you disclose the categories of personal information you hold about that person, where it came from, why you collect, sell or share it, and who receives it (§ 1798.110(a)).
- Risk assessments: required before selling or sharing personal information, processing sensitive personal information and the other activities listed in regs § 7150(b). Processing that began before 2026 and continues must be assessed by December 31, 2027 (§ 7155(b)).
- Data protection assessments in states such as Virginia, for targeted advertising, the sale of personal data, risky profiling, sensitive data and other heightened-risk processing (§ 59.1-580(A)). Our Virginia guide covers who the law reaches.
Each assessment starts from the processing it describes: the data, the systems, the purpose and the recipients. The impact assessment template walks a GDPR DPIA or a state assessment once you have that list.
Each tool in short
What each one is, who it fits, how it meets the rows, and what to confirm with the vendor. Most of them also sell whole privacy suites; if you are leaving the largest one, our OneTrust alternatives page compares the lighter options.
Ketch
What it is
A privacy platform whose data mapping uses connectors and detection agents to find systems, then classifies data down to tables, columns and cells. Ketch calls the resulting map your record of processing activities.
Who it fits
A firm with a wide SaaS and database estate that wants the same map to feed a California risk assessment and its request handling.
What the rule requires and whether it meets it
It reads vendor contracts and drops their retention terms, data categories and sub-processors into each system record, flags cross-border transfers, and produces record reports and audit exports. Its page says the map pre-fills DPIA, PIA, TIA and CCPA risk assessment workflows.
Check with the vendor
Its pricing page puts data mapping on the Pro tier, which is quoted, not self-serve; the free plan is a consent banner. The pages we read do not say how purposes get into the record. Ask who writes them.
DataGrail
What it is
“Live Data Map”: system detection that alerts you when someone adds a new business app, plus machine-learning discovery inside SaaS apps, internal datastores and cloud warehouses.
Who it fits
A firm whose stack is mostly SaaS and keeps growing, where the real risk is the app nobody told you about.
What the rule requires and whether it meets it
It generates the record of processing activities from the map and says it speeds up DPIAs. For common business apps it names the known uses and risks from its own library, without a scan.
Check with the vendor
Its record of processing page says the record exports as CSV or PDF, but the pages we read do not describe retention or transfer fields, or whether its Request Manager searches the map. Ask for a sample export.
MineOS
What it is
Discovery through single sign-on and an email discovery scan, which finds the tools staff signed up for, plus a cloud scan for your own data stores.
Who it fits
A firm that suspects its real list of systems is longer than the one IT keeps.
What the rule requires and whether it meets it
After discovery its AI suggests data types and purposes for each activity; you accept them, connect your most important systems and fill the gaps by hand. The record and a DPIA report export to CSV with one click.
Check with the vendor
Ask exactly what the email discovery scan reads and where its findings are stored. Retention periods and transfers are not described on the pages we read.
OneTrust
What it is
Its data mapping sits in “Privacy Operations”: asset detection through identity, cloud and IT-inventory connectors, then personal data detection inside those assets.
Who it fits
A firm already running OneTrust for consent or requests, or one with an IT asset inventory to connect.
What the rule requires and whether it meets it
It auto-generates the record of processing activities, identifies data transfers, and runs PIA, DPIA and TIA workflows. Discovery for individual requests is part of its separate DSR product.
Check with the vendor
The page we read does not describe retention fields or exporting the record. It is built for large programs; lighter options are on the alternatives page.
Osano
What it is
Data mapping that starts from single sign-on and other “umbrella sources” to cut the number of integrations, then discovers sources and fields.
Who it fits
A small privacy team that wants discovery and data-owner questionnaires in one place, and help moving an existing map from a spreadsheet or OneTrust.
What the rule requires and whether it meets it
It auto-fills Article 30 records, maps cross-border transfers, pre-fills DPIA and RoPA questionnaires, and runs data discovery inside its Subject Rights Management. Data labels tie categories to lawful basis and retention rules.
Check with the vendor
Data mapping is sold after a consultation, not on its self-serve consent plans, and the pages we read do not give an export format for the record.
TrustArc
What it is
“Data Mapping & Risk Manager”: an inventory built from integrations and AI-assisted record creation, with risk scoring on each activity.
Who it fits
A firm that is a processor for its clients as well as a controller, such as an agency or a SaaS provider, and so needs both kinds of record.
What the rule requires and whether it meets it
Its AI pre-fills purposes, legal bases, retention, data subjects, recipients, locations and transfers for people to review. It produces Article 30 reports for controller and processor, with configurable exports, and can trigger a DPIA from a high-risk record.
Check with the vendor
Field-level discovery comes through integrations and partner tools; ask which are included. Its own FAQ says the CCPA does not expressly require a GDPR-style record.
GDPR Register
What it is
A register built in Estonia for records, vendors, assessments and requests, filled in by your own team, with an AI assistant that suggests a lawful basis.
Who it fits
A firm moving off a spreadsheet, especially one led from the EU. It lists Excel import among its features.
What the rule requires and whether it meets it
It has a field for every Art. 30 item: purpose, data and subject categories, recipients, transfers with their safeguards, retention and security measures. On its top plan it reads connected apps from Microsoft 365 or Google Workspace into a review queue.
Check with the vendor
Its discovery finds apps, not the data inside them. Its request module logs requests rather than searching your systems. The DPIA workflow is on a higher plan.
Five questions to ask in the demo
The table shows where vendor pages go quiet. These questions close the gaps before you sign, and the answers should come in writing.
- Which plan includes data mapping, and is discovery a separate module on top of it?
- Does discovery read the data inside a system, or only the list of apps your staff sign into?
- Where do purposes and retention periods come from: your team, a suggestion we accept, or a contract?
- Can I export the full record as a file today, in the format a supervisory authority would read?
- If we also process data for clients, does it keep the processor’s record under Art. 30(2) as well?
How we compared them
We picked tools that sell data mapping or a record of processing activities as a named product: tools led by automated discovery, tools that mix discovery with questionnaires to data owners, and a register your own team fills in. Tools that sell requests, consent and assessments as one program are compared on our privacy management software page.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-22; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
We found no free plan that includes data mapping. So “paid plan” in this table marks a feature the vendor’s own plan page places on a higher tier than its basic record.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
Is a spreadsheet enough for an Article 30 record?
The GDPR asks for the record in writing, and says electronic form counts (Art. 30(3)). It does not name a format, so a well-kept spreadsheet can meet the duty. The trouble is keeping it current as systems change, which is the problem these tools are sold to solve. Our data map template is a free place to start.
What is the difference between a data map and a record of processing activities?
A data map is your working inventory: systems, data, flows and owners. The record is a legal document built from it, organised by processing activity and holding the items Art. 30(1) lists. Most tools here build the map first and generate the record from it.
Does the CCPA require a data map?
Not by name. But answering a request to know means listing the categories, sources, purposes and recipients for one person (§ 1798.110(a)), and a risk assessment asks for the same facts about an activity. Without a map, each request starts from zero. Our DSAR tools comparison covers the request side.
Can automated discovery fill in the whole record?
Discovery finds systems and data categories well. Purposes and retention periods are decisions your firm makes, and even the vendors that pre-fill them say a person reviews the result: TrustArc’s records “still require stakeholder review”, and MineOS has you accept its suggestions and fill the gaps by hand.
Are there free data mapping tools?
We found no free plan that includes data mapping on the pages we read. Ketch’s free plan is a consent banner, and GDPR Register offers a trial rather than a free tier. A spreadsheet or our template costs nothing and meets the written-record rule; software earns its price when your list of systems changes faster than anyone updates the sheet.