GDPR Data Mapping

1. Data Inventory (Article 30 Records of Processing)

• Purpose and lawful basis (consent, contract, legal obligation, vital interests, public task, legitimate interests — with the LI balancing test documented)
• Categories of data subjects and personal data (special categories flagged: health, biometrics, political, etc.)
• Recipients including subprocessors and international transfers
• Retention periods with the justification for each
• Security measures (technical and organizational)

2. Data Flow Mapping

• Systems inventory cross-referenced: which system holds which data fields, where backups and logs replicate them
• Marketing/CRM/analytics flows separately — consent state travels with the data
• Third-country transfers: identify mechanisms (adequacy decisions, SCCs, EU-US DPF) and conduct transfer impact assessments

3. Data Subject Rights Readiness (Articles 15–22)

• Verify operational ability to: access, rectify, erase, restrict, port, and object — within one month
• Identity verification without excessive data collection
• Erasure reality check: backups, logs, analytics stores — document what "deletion" means per system
• Consent capture proof: when, how, what was shown (for consent-based processing)

4. Breach Response (Articles 33–34)

• 72-hour supervisory authority notification: template ready, decision tree for "risk to rights and freedoms"
• Internal escalation path that reaches the DPO fast (detection → assessment → notify)
• Documentation of every breach decision, including non-notified ones with reasoning

5. Accountability Extras

• DPIA process for high-risk processing (Article 35): criteria, completed DPIAs, residual risk sign-off
• Privacy notices match actual practice (Article 13/14)
• Processor contracts include Article 28 clauses

Output