PII data map starter questionnaire

Overview

Data map underpins GDPR/CCPA programs—start simple spreadsheet before fancy software.

Columns

Data category, system of record, flows to/from, legal basis, retention, deletion method, DPO owner.

Workshops

Department interviews 45 min each; bring pizza for manufacturing floor supervisors—they know shadow Excel silos.

Outputs

Visual map Level 0 for executives; detailed annex technical.

Update trigger

New CRM or marketing automation mandates refresh within 30 days.

Pitfalls

Assuming cloud = vendor problem—controller duties remain on client/you per contract nuances legal review.