GDPR Data Mapper
Overview
Produce a clear, auditable map of personal-data processing and the core GDPR artifacts that depend on it. Output is a structured draft to be reviewed by a DPO or counsel — this skill does not give legal advice.
Keywords: GDPR, data mapping, RoPA, Article 30, record of processing, lawful basis, consent, legitimate interest, retention schedule, data subject rights, DSAR, data minimization, special category data, processor, controller, cross-border transfer, DPIA.
Workflow
- Inventory processing activities. List each distinct purpose for which personal data is used (e.g. "account management", "marketing emails", "fraud detection"). One activity per purpose.
- For each activity, capture the RoPA fields (see
templates/ropa-template.md): controller/processor role, purpose, data categories, data subjects, recipients, retention, transfers, and security measures.
- Classify the data. Flag special category data (health, biometrics, religion, etc., Art. 9) and children's data — these need stronger justification. Apply data minimization: challenge every field ("why do we hold this?").
- Determine the lawful basis for each activity using the decision guide in
references/lawful-basis-guide.md. Exactly one of the six bases per purpose; document the reasoning. For legitimate interest, note that a balancing test (LIA) is required.
- Set retention. Define a concrete retention period and trigger per data category (see
references/retention-and-rights.md). "Indefinite" is not acceptable.
- Map data-subject rights readiness. For each activity, note how access, erasure, rectification, portability, restriction, and objection would be fulfilled — and any blockers (e.g. data in backups, third parties).
- Flag transfers and DPIA triggers. Note any transfers outside the EEA (and the safeguard: adequacy decision, SCCs) and whether the activity likely needs a DPIA (large-scale, special category, systematic monitoring).
- Summarize risks and gaps — missing basis, over-retention, undocumented processors, no DSAR path.
Decision Aids
| Question |
Where |
| Which lawful basis applies? |
references/lawful-basis-guide.md |
| How long can we keep this? |
references/retention-and-rights.md |
| What goes in the record? |
templates/ropa-template.md |
| Does this need a DPIA? |
Large-scale + (special category OR systematic monitoring OR new tech) → likely yes |
Worked Example (one activity)
| Field |
Value |
| Activity |
Marketing newsletter |
| Role |
Controller |
| Purpose |
Send product updates to subscribers |
| Data categories |
Name, email, open/click events |
| Data subjects |
Newsletter subscribers |
| Lawful basis |
Consent (Art. 6(1)(a)) — opt-in checkbox, logged |
| Recipients |
Email service provider (processor, DPA signed) |
| Retention |
Until unsubscribe + 30 days, then deleted |
| Transfers |
ESP in US — SCCs in place |
| Rights |
Unsubscribe link (objection); export on request (portability) |
Best Practices
- One purpose = one activity. Don't lump unrelated processing together.
- Minimize first. The cheapest compliance is data you never collected.
- Exactly one lawful basis per purpose, documented — you can't switch later to dodge a request.
- Concrete retention periods with triggers, never "as long as needed".
- Treat backups and third parties explicitly in rights fulfillment.
- Keep the RoPA living — update it when a new tool or purpose appears.
Common Pitfalls
- Using consent when you can't truly offer a free choice (use another basis).
- Treating legitimate interest as a catch-all without a balancing test.
- Forgetting processors (analytics, email, CRM) in the recipients list.
- Indefinite retention or no deletion trigger.
- Missing special category flags, which demand an Art. 9 condition on top of the Art. 6 basis.
- No documented path for erasure/portability, discovered only when a DSAR arrives.
This is a drafting aid, not legal advice. Have a DPO or qualified counsel review the output.
1---2name: gdpr-data-mapper3description: Maps how personal data flows through a system and produces GDPR artifacts — a Record of Processing Activities (RoPA), lawful-basis analysis, retention schedule, and data-subject-rights readiness — for each processing activity. Use this skill when the user asks to "map our data", "create a RoPA / Article 30 record", "do a GDPR data mapping", "figure out our lawful basis", "build a retention schedule", "prepare for a DSAR / data subject request", or assess privacy/personal-data handling. Not legal advice — produces a structured draft for review by counsel/DPO.4license: MIT5---67# GDPR Data Mapper89## Overview1011Produce a clear, auditable map of personal-data processing and the core GDPR artifacts that depend on it. Output is a structured draft to be reviewed by a DPO or counsel — **this skill does not give legal advice**.1213Keywords: GDPR, data mapping, RoPA, Article 30, record of processing, lawful basis, consent, legitimate interest, retention schedule, data subject rights, DSAR, data minimization, special category data, processor, controller, cross-border transfer, DPIA.1415## Workflow16171. **Inventory processing activities.** List each distinct purpose for which personal data is used (e.g. "account management", "marketing emails", "fraud detection"). One activity per purpose.182. **For each activity, capture the RoPA fields** (see `templates/ropa-template.md`): controller/processor role, purpose, data categories, data subjects, recipients, retention, transfers, and security measures.193. **Classify the data.** Flag **special category** data (health, biometrics, religion, etc., Art. 9) and children's data — these need stronger justification. Apply data minimization: challenge every field ("why do we hold this?").204. **Determine the lawful basis** for each activity using the decision guide in `references/lawful-basis-guide.md`. Exactly one of the six bases per purpose; document the reasoning. For legitimate interest, note that a balancing test (LIA) is required.215. **Set retention.** Define a concrete retention period and trigger per data category (see `references/retention-and-rights.md`). "Indefinite" is not acceptable.226. **Map data-subject rights readiness.** For each activity, note how access, erasure, rectification, portability, restriction, and objection would be fulfilled — and any blockers (e.g. data in backups, third parties).237. **Flag transfers and DPIA triggers.** Note any transfers outside the EEA (and the safeguard: adequacy decision, SCCs) and whether the activity likely needs a DPIA (large-scale, special category, systematic monitoring).248. **Summarize risks and gaps** — missing basis, over-retention, undocumented processors, no DSAR path.2526## Decision Aids2728| Question | Where |29| --- | --- |30| Which lawful basis applies? | `references/lawful-basis-guide.md` |31| How long can we keep this? | `references/retention-and-rights.md` |32| What goes in the record? | `templates/ropa-template.md` |33| Does this need a DPIA? | Large-scale + (special category OR systematic monitoring OR new tech) → likely yes |3435## Worked Example (one activity)3637| Field | Value |38| --- | --- |39| Activity | Marketing newsletter |40| Role | Controller |41| Purpose | Send product updates to subscribers |42| Data categories | Name, email, open/click events |43| Data subjects | Newsletter subscribers |44| Lawful basis | **Consent** (Art. 6(1)(a)) — opt-in checkbox, logged |45| Recipients | Email service provider (processor, DPA signed) |46| Retention | Until unsubscribe + 30 days, then deleted |47| Transfers | ESP in US — SCCs in place |48| Rights | Unsubscribe link (objection); export on request (portability) |4950## Best Practices5152- **One purpose = one activity.** Don't lump unrelated processing together.53- **Minimize first.** The cheapest compliance is data you never collected.54- **Exactly one lawful basis per purpose**, documented — you can't switch later to dodge a request.55- **Concrete retention periods with triggers**, never "as long as needed".56- **Treat backups and third parties** explicitly in rights fulfillment.57- **Keep the RoPA living** — update it when a new tool or purpose appears.5859## Common Pitfalls6061- Using **consent** when you can't truly offer a free choice (use another basis).62- Treating **legitimate interest** as a catch-all without a balancing test.63- Forgetting **processors** (analytics, email, CRM) in the recipients list.64- **Indefinite retention** or no deletion trigger.65- Missing **special category** flags, which demand an Art. 9 condition on top of the Art. 6 basis.66- No documented path for **erasure/portability**, discovered only when a DSAR arrives.6768> This is a drafting aid, not legal advice. Have a DPO or qualified counsel review the output.
JayRHa