How to Conduct a Data Mapping Exercise

Data mapping - sometimes called a data inventory or Record of Processing Activities (ROPA) - is the process of documenting all the personal data your business holds, where it comes from, where it goes, who can access it, and how long you keep it. It is a core requirement of UK GDPR and the starting point for almost every other compliance activity.

Why data mapping matters

Without a data map, you cannot comply with most UK GDPR obligations. You cannot respond accurately to Subject Access Requests, conduct a proper DPIA, or assess the impact of a data breach. Regulators increasingly expect to see a data map as evidence of your accountability.

Step 1 - List your data categories

Start by identifying every category of personal data your business holds. Common categories for SMEs include:

• Customer and prospect data (names, contact details, purchase history)
• Employee and contractor data (personal details, payroll, performance records, health information)
• Supplier and partner contact data
• Website visitor data (analytics, cookies, enquiry forms)
• Financial records containing personal data

Step 2 - For each category, answer six questions

• What is the data? (fields held, sensitivity level)
• Where does it come from? (direct from individual, purchased, from a third party)
• Where is it stored? (CRM, spreadsheet, cloud storage, paper files, email)
• Who has access? (internal roles, third-party processors)
• What is your lawful basis for processing it?
• How long do you retain it and what is your deletion process?

Step 3 - Map your data flows

Document how data moves: from collection through to deletion. Note every point where data is shared with a third party - a payroll provider, a CRM platform, a marketing tool. Each of these third parties is a data processor and must have a written Data Processing Agreement with you.

Step 4 - Review and maintain

A data map is a living document. Set a review schedule - at minimum annually, and whenever you adopt a new system, change a process, or begin a new data collection activity. Assign clear ownership to keep it current.

Back to all guides