Data Mapping
The process of identifying and documenting what personal data an organization collects, where it is stored, and how it flows.
Data mapping (also called data inventory or data cataloging) is the process of creating a comprehensive record of all personal data within an organization. This includes: what data is collected, where it is stored, how it is processed, who has access, how it flows between systems, and what retention policies apply. Data mapping is foundational to privacy compliance — you cannot protect data you don't know about. It supports GDPR requirements for Records of Processing Activities (ROPA) and CCPA requirements for disclosing data collection practices. Effective data mapping should be ongoing, not a one-time exercise, as data practices evolve continuously.