# Gdpr Data Mapping

> Build a GDPR-compliant data inventory — record of processing activities, lawful basis mapping, data subject rights readiness, and breach response procedures. Use for GDPR audits and privacy programs.

- Skill: `securityskills/gdpr-data-mapping` (Agent Skill)
- Install (CLI): `npx skillmds@latest add securityskills/gdpr-data-mapping`
- Raw SKILL.md: https://api.skillmd.com/api/skills/securityskills/gdpr-data-mapping/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: securityskills (https://skillmd.com/u/securityskills)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/securityskills/gdpr-data-mapping

---


# GDPR Data Mapping

Create the records and workflows that demonstrate GDPR compliance.

## 1. Data Inventory (Article 30 Records of Processing)

For each processing activity capture:

- Purpose and lawful basis (consent, contract, legal obligation, vital interests, public task, legitimate interests — with the LI balancing test documented)
- Categories of data subjects and personal data (special categories flagged: health, biometrics, political, etc.)
- Recipients including subprocessors and international transfers
- Retention periods with the justification for each
- Security measures (technical and organizational)

## 2. Data Flow Mapping

- Systems inventory cross-referenced: which system holds which data fields, where backups and logs replicate them
- Marketing/CRM/analytics flows separately — consent state travels with the data
- Third-country transfers: identify mechanisms (adequacy decisions, SCCs, EU-US DPF) and conduct transfer impact assessments

## 3. Data Subject Rights Readiness (Articles 15–22)

- Verify operational ability to: access, rectify, erase, restrict, port, and object — within one month
- Identity verification without excessive data collection
- Erasure reality check: backups, logs, analytics stores — document what "deletion" means per system
- Consent capture proof: when, how, what was shown (for consent-based processing)

## 4. Breach Response (Articles 33–34)

- 72-hour supervisory authority notification: template ready, decision tree for "risk to rights and freedoms"
- Internal escalation path that reaches the DPO fast (detection → assessment → notify)
- Documentation of every breach decision, including non-notified ones with reasoning

## 5. Accountability Extras

- DPIA process for high-risk processing (Article 35): criteria, completed DPIAs, residual risk sign-off
- Privacy notices match actual practice (Article 13/14)
- Processor contracts include Article 28 clauses

## Output

RoPA spreadsheet/registry, data-flow diagrams, rights-request runbook, breach decision tree, and a gap list prioritized by risk.