How to map GDPR data flows
You cannot protect or account for personal data you have not mapped. A data-flow map is the foundation of GDPR compliance and the Record of Processing Activities.
Why data mapping comes first
Almost every GDPR obligation depends on knowing what personal data you hold, where it lives, and where it flows. Data-subject requests, breach notification, retention, and the Record of Processing Activities all assume you have that map. Without it, you are guessing - and guessing about personal data is exactly what regulators penalize.
What to capture for each data flow
| Element | Question it answers |
|---|---|
| Data category | What personal data is it - name, email, health, financial? |
| Purpose | Why are you processing it? |
| Lawful basis | What legal ground justifies it - consent, contract, legitimate interest? |
| Source & storage | Where does it come from and where does it live? |
| Recipients | Which processors and third parties receive it? |
| Retention | How long is it kept and when is it deleted? |
The mapping process
- 1Inventory the systems and processes that touch personal data.
- 2For each, capture the data categories, purpose, and lawful basis.
- 3Trace where data comes from, where it is stored, and who it is shared with.
- 4Note cross-border transfers and the safeguards that cover them.
- 5Record retention periods and deletion triggers.
- 6Assemble it into a Record of Processing Activities and keep it current.
How SentriAI supports GDPR mapping
- Data classification helps identify where personal data lives across systems.
- GDPR compliance tooling structures the data-flow inventory and Record of Processing Activities.
- Vendor and processor relationships tie into vendor risk management for transfer safeguards.
- The record is versioned with an audit trail, so it stays current and defensible.
Frequently asked questions
What is GDPR data mapping?
It is the process of inventorying the personal data you hold and tracing how it flows through your systems and to third parties. For each flow you capture the data category, purpose, lawful basis, storage, recipients, and retention. This map underpins nearly every other GDPR obligation, from data-subject requests to breach response.
What is a Record of Processing Activities?
A Record of Processing Activities, or RoPA, is a documented inventory of how your organization processes personal data - the purposes, categories, recipients, transfers, and retention periods. GDPR requires many organizations to maintain one, and it is built directly from your data-flow map.
What lawful bases can I rely on under GDPR?
GDPR recognizes several, including consent, performance of a contract, legal obligation, vital interests, public task, and legitimate interests. Each processing activity in your data map should name the specific basis it relies on. Choosing and documenting the right basis is a core part of accountable data processing.
How often should a data-flow map be updated?
Whenever your processing changes - a new tool, a new vendor, a new data category - and reviewed periodically regardless. Data flows drift as the business evolves, and a Record of Processing Activities that is not maintained quickly becomes inaccurate, which is a liability rather than an asset in an audit.
Stay in the loop
One practical finance briefing a week - new guides, checklists, and benchmarks.
Map your data before the regulator asks
SentriAI structures your data-flow inventory and RoPA. Free to start, no card required.
Talk to us