What is data mapping?
Definition
Data mapping is the process of working out what personal data an organisation holds, where it comes from, where it is stored and who it is shared with. It is usually the first step in building a record of processing activities.
- Category
- Data
- Also called
- data map, information audit
- Last updated
An organisation can't protect or delete data it doesn't know it has. Data mapping answers four questions: what personal data do we hold, where did it come from, where does it live, and who gets it. The result is often a diagram or table showing how data flows from a sign-up form to a database to a marketing tool to a supplier.
The UK ICO describes an information audit or data-mapping exercise as a good way to begin documenting processing activities. It says to involve staff from across the organisation and to get senior management buy-in. The ICO's audit framework adds that a record of processing built without a data mapping exercise may be incomplete or inaccurate, which risks falling short of Article 30 of the UK GDPR.
What a map usually covers
- The categories of people (customers, staff, website visitors).
- The categories of personal data held about them.
- The purpose of each use.
- Who receives the data, including suppliers and transfers abroad.
- How long it is kept and how it is secured.
An example
A small online shop maps its data and finds customer emails in three places: the checkout system, a newsletter tool and an old spreadsheet on someone's laptop. The spreadsheet is the one nobody had in the privacy policy. Without the map, a customer asking for their data to be deleted would get an incomplete answer.
Why it matters to you
When you ask a company to delete or send you your data, how well it has mapped its data decides whether you get the full answer. Data mapping is also a business term in IT, where it means matching fields between two databases. This page covers the privacy meaning.
How to protect yourself
- 1
Ask what a company holds
Under laws like the UK and EU GDPR and California's CCPA you can usually ask a company for a copy of your personal data. The reply shows how far it knows where your data goes.
- 2
Ask for deletion in writing
Name the account and the email you used so the company can find every copy.
- 3
Map your own exposure
List where your name, address and phone number appear: old accounts, people-search sites, public records. Serus finds the data brokers that operate where you live and removes your listings.
- 4
Close accounts you no longer use
Each forgotten account is one more copy of your data on someone else's map.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is data mapping required by law?
The UK GDPR requires many organisations to keep a record of processing activities (Article 30). The ICO says a data-mapping exercise is a good way to start building one. Rules differ by size of organisation and country.
What is the difference between data mapping and data flow mapping?
Data flow mapping is one part of data mapping: it traces how data moves between systems and parties. A full data map also records what data is held and why.
What is a record of processing activities?
It is a written record of what personal data an organisation processes, why, who receives it and how long it is kept. Data mapping feeds into it.
Sources
- ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/
- ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/how-do-we-document-our-processing-activities/
- ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/records-of-processing-and-lawful-basis/
Something wrong or out of date? Tell us and we'll re-check it.