Map where personal data lives
Every other obligation depends on knowing what you hold. We build a data inventory from schemas, logs, analytics, backups, support tools and third-party processors, tagging fields as personal or special category and recording purpose, lawful basis, location and who can see them. This also feeds your record of processing activities under Article 30. Mapping is also the basis for a clean record of processing, and it gives your legal adviser accurate facts when they draft notices, processor contracts and any assessment the law requires.
Mapping nearly always reveals surprises: names in application logs, emails copied into spreadsheets, identifiers sent to analytics vendors, and production data in test databases. Finding them early is far cheaper than discovering them during a regulator query or a customer's request. Where data is copied into analytics warehouses, search indexes and AI training sets, we trace those flows too, because rights requests and retention rules apply to every copy, not only to the source system.
