GDPR Data Mapping
Create the records and workflows that demonstrate GDPR compliance.
1. Data Inventory (Article 30 Records of Processing)
For each processing activity capture:
- Purpose and lawful basis (consent, contract, legal obligation, vital interests, public task, legitimate interests — with the LI balancing test documented)
- Categories of data subjects and personal data (special categories flagged: health, biometrics, political, etc.)
- Recipients including subprocessors and international transfers
- Retention periods with the justification for each
- Security measures (technical and organizational)
2. Data Flow Mapping
- Systems inventory cross-referenced: which system holds which data fields, where backups and logs replicate them
- Marketing/CRM/analytics flows separately — consent state travels with the data
- Third-country transfers: identify mechanisms (adequacy decisions, SCCs, EU-US DPF) and conduct transfer impact assessments
3. Data Subject Rights Readiness (Articles 15–22)
- Verify operational ability to: access, rectify, erase, restrict, port, and object — within one month
- Identity verification without excessive data collection
- Erasure reality check: backups, logs, analytics stores — document what "deletion" means per system
- Consent capture proof: when, how, what was shown (for consent-based processing)
4. Breach Response (Articles 33–34)
- 72-hour supervisory authority notification: template ready, decision tree for "risk to rights and freedoms"
- Internal escalation path that reaches the DPO fast (detection → assessment → notify)
- Documentation of every breach decision, including non-notified ones with reasoning
5. Accountability Extras
- DPIA process for high-risk processing (Article 35): criteria, completed DPIAs, residual risk sign-off
- Privacy notices match actual practice (Article 13/14)
- Processor contracts include Article 28 clauses
Output
RoPA spreadsheet/registry, data-flow diagrams, rights-request runbook, breach decision tree, and a gap list prioritized by risk.