Map and classify data flows

Map and Classify Data Flows

Understanding how personal data moves through your systems is the first step to compliance. GDPR and CPRA require organizations to know where data comes from, how it is used, where it is stored, and who it is shared with. Mapping and classifying these flows creates the foundation for every other compliance measure.

Data Mapping

Document each stage of data handling.

• Identify collection points (forms, APIs, SDKs).

• Trace data movement between services, databases, and third parties.

• Visualize flows using diagrams or automated tools.

Data Classification

Label data by type and sensitivity.

• Personal data: email, IP address, cookie IDs.

• Sensitive data: health, biometrics, geolocation, children’s data.

• Operational data: logs, device details, error reports.
  This helps set retention rules and prioritize protections.

Ownership and Responsibility

Assign accountability for each data type.

• Define which teams or roles own collection, storage, and deletion.

• Make responsibilities clear across product, engineering, and security.

Example: Signup Form Flow

• User enters email and password on signup page.

• Data flows into authentication service.

• Email stored in primary user database; password hashed and salted.

• Activity logs stored separately in analytics platform.

Implementing Mapping in Practice

Database tagging

COMMENT ON COLUMN users.email IS 'personal data: identifier';
COMMENT ON COLUMN users.password_hash IS 'personal data: authentication';
COMMENT ON COLUMN users.dob IS 'sensitive data: age verification';

Simple flow diagram tools

• Use services like Lucidchart, Miro, or Draw.io to maintain diagrams.

• Keep diagrams updated when adding new integrations or features.

Quick Data Mapping Checklist

• Identify all points of personal data collection

• Document data movement across systems and vendors

• Classify data into personal, sensitive, or operational categories

• Assign ownership for each data type and flow

• Keep diagrams and records updated as systems evolve

Conclusion

Mapping and classifying data flows gives companies a complete picture of how personal data is handled, making it possible to apply the right safeguards, assign clear responsibilities, and prove compliance with confidence.