GDPR Data Mapping
Create the records and workflows that demonstrate GDPR compliance.
1. Data Inventory (Article 30 Records of Processing)
For each processing activity capture:
- Purpose and lawful basis (consent, contract, legal obligation, vital interests, public task, legitimate interests — with the LI balancing test documented)
- Categories of data subjects and personal data (special categories flagged: health, biometrics, political, etc.)
- Recipients including subprocessors and international transfers
- Retention periods with the justification for each
- Security measures (technical and organizational)
2. Data Flow Mapping
- Systems inventory cross-referenced: which system holds which data fields, where backups and logs replicate them
- Marketing/CRM/analytics flows separately — consent state travels with the data
- Third-country transfers: identify mechanisms (adequacy decisions, SCCs, EU-US DPF) and conduct transfer impact assessments
3. Data Subject Rights Readiness (Articles 15–22)
- Verify operational ability to: access, rectify, erase, restrict, port, and object — within one month
- Identity verification without excessive data collection
- Erasure reality check: backups, logs, analytics stores — document what "deletion" means per system
- Consent capture proof: when, how, what was shown (for consent-based processing)
4. Breach Response (Articles 33–34)
- 72-hour supervisory authority notification: template ready, decision tree for "risk to rights and freedoms"
- Internal escalation path that reaches the DPO fast (detection → assessment → notify)
- Documentation of every breach decision, including non-notified ones with reasoning
5. Accountability Extras
- DPIA process for high-risk processing (Article 35): criteria, completed DPIAs, residual risk sign-off
- Privacy notices match actual practice (Article 13/14)
- Processor contracts include Article 28 clauses
Output
RoPA spreadsheet/registry, data-flow diagrams, rights-request runbook, breach decision tree, and a gap list prioritized by risk.
1---2name: gdpr-data-mapping3description: Build a GDPR-compliant data inventory — record of processing activities, lawful basis mapping, data subject rights readiness, and breach response procedures. Use for GDPR audits and privacy programs.4---56# GDPR Data Mapping78Create the records and workflows that demonstrate GDPR compliance.910## 1. Data Inventory (Article 30 Records of Processing)1112For each processing activity capture:1314- Purpose and lawful basis (consent, contract, legal obligation, vital interests, public task, legitimate interests — with the LI balancing test documented)15- Categories of data subjects and personal data (special categories flagged: health, biometrics, political, etc.)16- Recipients including subprocessors and international transfers17- Retention periods with the justification for each18- Security measures (technical and organizational)1920## 2. Data Flow Mapping2122- Systems inventory cross-referenced: which system holds which data fields, where backups and logs replicate them23- Marketing/CRM/analytics flows separately — consent state travels with the data24- Third-country transfers: identify mechanisms (adequacy decisions, SCCs, EU-US DPF) and conduct transfer impact assessments2526## 3. Data Subject Rights Readiness (Articles 15–22)2728- Verify operational ability to: access, rectify, erase, restrict, port, and object — within one month29- Identity verification without excessive data collection30- Erasure reality check: backups, logs, analytics stores — document what "deletion" means per system31- Consent capture proof: when, how, what was shown (for consent-based processing)3233## 4. Breach Response (Articles 33–34)3435- 72-hour supervisory authority notification: template ready, decision tree for "risk to rights and freedoms"36- Internal escalation path that reaches the DPO fast (detection → assessment → notify)37- Documentation of every breach decision, including non-notified ones with reasoning3839## 5. Accountability Extras4041- DPIA process for high-risk processing (Article 35): criteria, completed DPIAs, residual risk sign-off42- Privacy notices match actual practice (Article 13/14)43- Processor contracts include Article 28 clauses4445## Output4647RoPA spreadsheet/registry, data-flow diagrams, rights-request runbook, breach decision tree, and a gap list prioritized by risk.
securityskills