In this guide 7 sections
Map personal data by listing every place it sits, from the CRM to chat groups and backups. For each place, record what is held, why, who can reach it, where it goes next and how long it stays. GullySystem’s data protection service builds this map before recommending any control.
List every place personal data sits
Start wider than the main software. A customer’s phone number may sit in the CRM, the billing system, an exported sheet and a chat group. It may also sit in an old enquiry inbox and last year’s backup.
Walk through how a customer, an employee and a supplier each enter the business. Every form, screen and file they touch goes on the list.
- Core software: CRM, billing, HR and payroll
- Website forms and the tools they feed
- Spreadsheets on shared and personal drives
- Email inboxes and chat groups
- Backups, old laptops and retired systems
Record five facts for each place
Keep each entry short. A single sentence per fact is enough to begin. Precision can come in a second pass.
The facts matter later. The Rules as published in the Gazette say a notice must include an itemised description of the data and its purpose. A map makes that notice accurate.
- What personal data is held
- Why it is held
- Who can open or export it
- Where it flows next, including vendors
- How long it stays
Ask each department about informal copies
System lists miss the informal copies. Ask one person from each department where they keep data that is not in the main software. Photos on phones and exports for a one-time report are common answers.
Ask about former staff too. Files created on a personal login and shared by link can stay reachable after the person leaves.
Mark what can be deleted or never collected
Mapping often turns up data nobody uses. A form may ask for date of birth only because the template did. Mark those fields to stop collecting.
Old enquiries and candidates who never joined are other common finds. Mark them too. Data that is not held needs no protection, so this step shrinks everything after it.
Keep the map current
A map drawn once goes stale within months. Name an owner and set a review date in the calendar.
Add a rule that any new tool, form or vendor joins the map before it goes live. Connected marketing tools are the entries most often forgotten.
Personal data map template
A sheet with one row per place data sits and columns for the five facts. Extra columns flag sensitive data such as health or children’s records, and fields to stop collecting. A review date sits at the top.
Open a blank worksheet to printQuestions owners ask
Can a scanning tool build the map for us?
Not on its own. A tool can find personal data in databases and drives. It cannot find chat groups, phone photos or why each field was collected. People still have to supply those answers.
Should backups go on the map?
Yes. Backups hold copies of everything, often for longer than the live system. Record where they are kept, who can restore them and when old copies expire.
Who should own the map in a small business?
Usually the owner or a finance or operations head. The owner of the map receives requests, adds new systems and books the next review.