A data map traces how each category of data moves through a company: the source system, each destination or outside recipient, the purpose, the people and personal data involved, whether it leaves the country, the retention rule and the owner. Build one row per flow step, starting from your data inventory, and mark unchecked rows UNVERIFIED.
- An inventory lists what you hold; a map shows where it moves.
- Describe flows. Do not paste live records, links or identifiers into the map.
- Under the GDPR, a map supplies most of what a record of processing activities must contain.
FREE WORKING TOOL · NO ACCOUNT REQUIRED
Build a data map and download your CSV
Add a row for each step a record category takes between systems, teams and outside recipients. Describe the flow; do not paste live records, links or identifiers.
This builder creates the file in your browser. Your entries are not submitted by this tool and disappear when you leave or reload. Use descriptions and invented examples, without private records or access details.
1 row in your working file. Save a download before leaving this page.
To share the tool, link to this page. Your downloaded file is a working document; it does not establish approval, rights, eligibility or an outcome.
Download the data mapping template.
Use the free CSV builder on this page, or open the data mapping template with an illustrative support-ticket flow. No email or account is required.
This is a working template, not legal advice. Use it to organize facts and questions, then have qualified counsel review anything you sign, adopt or delete.
Data map, inventory or dictionary?
Each answers a different question. The data inventory lists the record categories the company holds and who owns them. The data dictionary explains the fields inside one category. The data map follows a category as it moves between systems, teams and outside parties.
A worked example: one support ticket
This illustrative flow follows a customer report from a web form to backups. Two rows still say UNKNOWN for the country of storage. That is a finding to resolve, not a gap to fill from memory.
| Flow step | Source system | Destination or recipient | Purpose | Leaves the country |
|---|---|---|---|---|
| Customer reports a problem | Website contact form | Help desk | Resolve the customer issue | NO |
| Escalation to engineering | Help desk | Engineering issue tracker | Investigate a product defect | NO |
| Weekly reporting | Help desk | Analytics warehouse | Measure resolution time | UNKNOWN |
| Backups | Help desk | Backup service provider | Disaster recovery | UNKNOWN |
How a data map relates to GDPR Article 30
Article 30 says: "Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility." The record must include, among other items, the purposes of the processing, "a description of the categories of data subjects and of the categories of personal data", the categories of recipients, transfers to third countries, "where possible, the envisaged time limits for erasure of the different categories of data", and a general description of security measures.
The map columns line up with those items: purpose, people concerned, personal data categories, destination or recipient, leaves the country, retention rule and security measures. The record itself "shall be in writing, including in electronic form."
Article 30(5) exempts an organisation employing fewer than 250 persons unless its processing is likely to result in a risk to people's rights and freedoms, is not occasional, or includes special categories or criminal offence data. Regular processing may not count as occasional, so check with counsel before relying on the exemption. Pair the map with the data retention policy template to fill in erasure time limits; the storage limitation principle in Article 5(1)(e) is why each limit needs a purpose behind it.
Build the map in five steps
- Pick one record category from your inventory and its owner.
- Ask the owner where the data enters the company and list each system it reaches.
- Add every outside recipient: vendors, partners and backup services.
- For each step, record the purpose, the people concerned and the personal data involved.
- Mark each row UNVERIFIED until the owner confirms it, then record the date.
What a map shows a data buyer
A map also shows which records connect: a request, its investigation and the outcome. Connected histories are what AI developers ask about, and the map lets you describe them without exporting anything.
Origin Data Partners is an independent data partner that helps companies get their data bought. You can check whether your company could qualify with company details only, or follow one workflow end to end with the workflow mapping guide.
Common questions
What is data mapping?
Data mapping is tracing how each category of data moves through a company: where it comes from, which systems and outside parties it reaches, why, and who is responsible at each step.
What should a data mapping template include?
The flow step, record category, source system, destination or recipient, purpose, people concerned, personal data categories, whether data leaves the country, the retention rule, security measures, the owner and a verification status.
Is a data map the same as a record of processing activities?
Not quite. A record of processing activities is the document GDPR Article 30 requires. A data map is the working tool that supplies most of its contents, such as purposes, categories, recipients and erasure time limits.
Do small companies need a record of processing activities?
Article 30(5) exempts organisations with fewer than 250 employees, but not when processing is likely to risk people's rights, is not occasional, or includes special category or criminal offence data. Whether regular processing counts as occasional is a question to check with counsel.
What is the difference between a data map and a data inventory?
An inventory lists the record categories a company holds. A map follows each category between systems and recipients. Start with the data inventory template.
Is this data mapping template legal advice?
No. It is a working template for documenting data flows. Have your privacy lead or counsel review the map before relying on it for compliance.