GDPR Data Mapper

Overview

Produce a clear, auditable map of personal-data processing and the core GDPR artifacts that depend on it. Output is a structured draft to be reviewed by a DPO or counsel — this skill does not give legal advice.

Keywords: GDPR, data mapping, RoPA, Article 30, record of processing, lawful basis, consent, legitimate interest, retention schedule, data subject rights, DSAR, data minimization, special category data, processor, controller, cross-border transfer, DPIA.

Workflow

1. Inventory processing activities. List each distinct purpose for which personal data is used (e.g. "account management", "marketing emails", "fraud detection"). One activity per purpose.
2. For each activity, capture the RoPA fields (see templates/ropa-template.md): controller/processor role, purpose, data categories, data subjects, recipients, retention, transfers, and security measures.
3. Classify the data. Flag special category data (health, biometrics, religion, etc., Art. 9) and children's data — these need stronger justification. Apply data minimization: challenge every field ("why do we hold this?").
4. Determine the lawful basis for each activity using the decision guide in references/lawful-basis-guide.md. Exactly one of the six bases per purpose; document the reasoning. For legitimate interest, note that a balancing test (LIA) is required.
5. Set retention. Define a concrete retention period and trigger per data category (see references/retention-and-rights.md). "Indefinite" is not acceptable.
6. Map data-subject rights readiness. For each activity, note how access, erasure, rectification, portability, restriction, and objection would be fulfilled — and any blockers (e.g. data in backups, third parties).
7. Flag transfers and DPIA triggers. Note any transfers outside the EEA (and the safeguard: adequacy decision, SCCs) and whether the activity likely needs a DPIA (large-scale, special category, systematic monitoring).
8. Summarize risks and gaps — missing basis, over-retention, undocumented processors, no DSAR path.

Decision Aids

| Question | Where | | --- | --- | | Which lawful basis applies? | references/lawful-basis-guide.md | | How long can we keep this? | references/retention-and-rights.md | | What goes in the record? | templates/ropa-template.md | | Does this need a DPIA? | Large-scale + (special category OR systematic monitoring OR new tech) → likely yes |

Worked Example (one activity)

| Field | Value | | --- | --- | | Activity | Marketing newsletter | | Role | Controller | | Purpose | Send product updates to subscribers | | Data categories | Name, email, open/click events | | Data subjects | Newsletter subscribers | | Lawful basis | Consent (Art. 6(1)(a)) — opt-in checkbox, logged | | Recipients | Email service provider (processor, DPA signed) | | Retention | Until unsubscribe + 30 days, then deleted | | Transfers | ESP in US — SCCs in place | | Rights | Unsubscribe link (objection); export on request (portability) |

Best Practices

• One purpose = one activity. Don't lump unrelated processing together.
• Minimize first. The cheapest compliance is data you never collected.
• Exactly one lawful basis per purpose, documented — you can't switch later to dodge a request.
• Concrete retention periods with triggers, never "as long as needed".
• Treat backups and third parties explicitly in rights fulfillment.
• Keep the RoPA living — update it when a new tool or purpose appears.

Common Pitfalls

• Using consent when you can't truly offer a free choice (use another basis).
• Treating legitimate interest as a catch-all without a balancing test.
• Forgetting processors (analytics, email, CRM) in the recipients list.
• Indefinite retention or no deletion trigger.
• Missing special category flags, which demand an Art. 9 condition on top of the Art. 6 basis.
• No documented path for erasure/portability, discovered only when a DSAR arrives.

> This is a drafting aid, not legal advice. Have a DPO or qualified counsel review the output.