Personal data map

Use this to build or refresh a record of what personal data the company holds.

List systems and data

Start from the system inventory and note its last update. For each system record the owner, the kinds of people whose data it holds (customers, staff, leads), the categories of data, any sensitive data, and where it is hosted. Ask the owner when the inventory is older than six months.

Record purpose and retention

For each system and data set record:

• the purpose, in the owner's words;
• the legal basis only if a named document states it;
• how long it is kept, and the source of that rule;
• who receives it, inside and outside the company;
• transfers outside the region, with the mechanism if documented.

Leave a field blank and mark it when no source supports it. Do not pick a legal basis or a retention period yourself.

Open questions

List each blank field with the owner to ask and a date. Flag systems that hold sensitive data with no stated purpose or retention, for the privacy owner.

Never state a legal basis or say the company is compliant without evidence. This is not legal advice. Do not edit systems or delete data; draft the map for the owner to approve.