Work Through the Steps
Choose One Activity
Start with a recognisable activity, such as workshop booking, recruitment or customer support. Name its business owner and the people whose information is involved. Record data categories, such as contact details or support messages, rather than copying actual personal records into the map. Keep different purposes separate: answering an enquiry and adding someone to a marketing list are different activities.
Follow the Actual Handoffs
Ask the person doing the work to walk through a recent example without exposing personal records. Follow the information from its source to each system, file, recipient and export. Add a row for every handoff or working copy. Include shared inboxes, spreadsheets, messaging tools and backups where relevant. A supplier name alone does not explain what that supplier receives or does.
Record Purpose, Access and Location
For each row, describe why the information is used, which data categories are needed and who can see it. Distinguish staff access from access by a supplier or another recipient. Identify hosting and remote support locations when known. Reference the notice, agreement or internal instruction the owner says applies; assessing whether it is adequate is a separate task.
Make Unknowns Visible
Write 'not verified' when a location, recipient or deletion process is unclear. Give the question an owner and an evidence request. For retention, distinguish an approved rule, observed practice and a proposal still awaiting a decision. Include exported copies and ask what happens in backups. Do not turn a convenient storage setting into an assumed legal retention period.
Confirm the Map and Choose Actions
Review the rows with the business owner and system administrator. Link evidence references, such as an access review or supplier response, without embedding personal records. Resolve a small set of useful actions: remove an unnecessary export, narrow access or agree a deletion process. Revisit the map when the activity, system or supplier changes. For DPDP planning, check current applicability and commencement separately; the framework has phased implementation.
Fictional Example: Riverstone Training
Riverstone Training runs workshops. Its operations lead follows a registration through the booking system, confirmation emails and a trainer's attendance export. In this fictional example, supplier access locations and deletion decisions still need confirmation.
- Activity
- Register participants and deliver a booked workshop.
- People and Data
- Participants: name, business email, selected workshop and attendance status.
- Flow
- Website form → booking system → confirmation email and restricted trainer attendance file. The trainer receives names and session details, not the full booking record.
- Next Decision
- The operations lead and IT administrator will confirm supplier access locations and approve how booking records, exports and backups reach the end of their lifecycle.
Watch For
- Mapping only the main application and missing email attachments or exported copies.
- Treating a policy statement as evidence of what actually happens.
- Treating an unresolved recipient, retention or ownership question as a confirmed fact.
Your Next Step
Ask the activity owner to verify each handoff, then assign the open questions. Use the resulting map to support a separate privacy and security review; it does not establish compliance by itself.