---
name: "personal-data-map"
description: "Map what personal data is held, where, why, how long, and who receives it."
triggers: ["data map", "data inventory", "RoPA", "personal data", "where is our data"]
version: "1"
---
# Personal data map
Use this to build or refresh a record of what personal data the company holds.
## List systems and data
Start from the system inventory and note its last update. For each system
record the owner, the kinds of people whose data it holds (customers, staff,
leads), the categories of data, any sensitive data, and where it is hosted.
Ask the owner when the inventory is older than six months.
## Record purpose and retention
For each system and data set record:
- the purpose, in the owner's words;
- the legal basis only if a named document states it;
- how long it is kept, and the source of that rule;
- who receives it, inside and outside the company;
- transfers outside the region, with the mechanism if documented.
Leave a field blank and mark it when no source supports it. Do not pick a
legal basis or a retention period yourself.
## Open questions
List each blank field with the owner to ask and a date. Flag systems that hold
sensitive data with no stated purpose or retention, for the privacy owner.
Never state a legal basis or say the company is compliant without evidence.
This is not legal advice. Do not edit systems or delete data; draft the map for
the owner to approve.