Before you rewrite the privacy policy, map the data

A list of tools is not a data map

Teams often start privacy work with a spreadsheet of applications: CRM, payroll, cloud infrastructure, support desk, analytics, email, and product databases. That inventory is useful, but it does not explain what happens to personal data.

One application may support several activities with different people, purposes, sharing arrangements, and retention periods. The CRM may hold prospect details for sales, customer contacts for account management, and event registrations for marketing. Treating all three as one row hides the decisions a privacy review needs to examine.

Start with the activity. Examples include recruiting an employee, creating a customer account, processing a support request, monitoring product usage, paying a supplier, or sending a marketing campaign. Then connect the systems and vendors involved.

Use one row for one processing activity

The first version can be a table. Give every row a name a product, sales, HR, or support owner would recognise. For each activity, record:

If a legal basis, consent record, contract, data-protection impact assessment, or customer instruction applies, link it to the row rather than storing it in a separate compliance universe.

Article 30 of the EU GDPR describes records of processing in similar operational terms: purposes, categories of people and data, recipients, international transfers, retention periods, and a general description of security measures. Even where a particular record-keeping rule does not apply to a company, these fields are a useful way to expose how data moves and why.

• the people the data relates to;
• the categories of personal data used;
• where the data comes from;
• why the company uses it;
• the internal systems and external recipients involved;
• the countries or regions in which it is stored or accessed;
• how long it is retained and what triggers deletion;
• the security measures that matter for that activity; and
• the person responsible for keeping the row accurate.

Interview the people who run the work

Policies rarely reveal the full processing picture. Speak to the people who operate the activity.

Ask product how accounts, telemetry, logs, support access, and AI features use customer or user information. Ask sales and marketing where lists originate, which enrichment services are used, and how opt-outs propagate. Ask HR about recruiting platforms, background checks, benefits providers, and offboarding. Ask finance about billing, tax, banking, and expense records.

Use plain questions:

The objective is not to catch people doing something wrong. It is to replace assumptions with an accurate operating picture.

• Whose information do you use?
• What do you need it for?
• Where do you receive it and where does it go?
• Who outside the company can access it?
• What would stop working if you deleted it?
• How do you know when it should be deleted?
• What changed in this workflow during the last six months?

Follow one real record through the workflow

Abstract descriptions can make every process sound clean. Choose one representative record and trace it from collection to deletion.

For a support request, that may mean the web form, support platform, email notification, internal chat, engineering ticket, diagnostic log, analytics system, backup, and any subprocessors that can access the content. A customer may enter sensitive information even if the form never asks for it. An engineer may copy part of the request into a second system to investigate it. A deletion process may remove the ticket but leave the attached log.

This walkthrough usually reveals more than asking where “support data” is stored. Repeat it for the activities with the highest volume, sensitivity, customer importance, or number of external recipients.

Turn gaps into decisions

A data map is valuable when it changes what the company does. Common findings include:

Do not try to resolve every finding inside the map. Record the decision, owner, and date. Some gaps require deletion or access changes. Others require a clearer notice, a contract update, a risk assessment, or a deliberate decision that the activity remains proportionate.

• a privacy notice that omits a real use or recipient;
• data collected because a default field exists rather than because the business needs it;
• retention described as “as long as necessary” without an operational deletion trigger;
• a vendor that receives more information than its task requires;
• international access that nobody had recorded;
• former users or employees whose records remain active; or
• an AI or analytics feature introduced without a privacy review.

Keep the map alive with change triggers

The initial exercise is only a snapshot. The Information Commissioner’s Office advises that records of processing reflect the current situation and be reviewed as activities change.

Define events that require an update:

Add the map review to product design, vendor onboarding, and major process changes. A quarterly owner check can catch quieter drift, but it should not be the only mechanism.

• launching a feature that uses personal data in a new way;
• adopting a new vendor, AI tool, analytics service, or integration;
• entering a new country or serving a new category of user;
• changing retention, sharing, or customer instructions;
• responding to an incident, rights request, or audit finding; or
• ending a system or supplier relationship.

A two-hour first pass

Do not wait for a perfect enterprise-wide exercise. Choose one important journey, such as customer onboarding, employee recruitment, or support, and map it with the people who run it.

That first row establishes the method. Expand by risk and business importance, not by trying to inventory every field in the company at once.

• Spend 20 minutes naming the activity and the people involved.
• Spend 40 minutes tracing collection, use, sharing, storage, and deletion.
• Spend 30 minutes recording the fields in one structured row.
• Spend 20 minutes identifying mismatches, unnecessary data, and missing owners.
• Spend 10 minutes assigning the next decisions and the update trigger.