Data Mapping: Inventorying Personal Data in Practice

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Building an inventory of personal data is the first concrete step in bringing any organization into compliance with the LGPD (Brazil’s General Data Protection Law), and without it, no compliance strategy holds up in practice.

What Data Mapping Is and Why It Matters So Much

When we talk about personal data protection under the LGPD (Lei Geral de Proteção de Dados, Brazil’s General Data Protection Law), data mapping is the foundation on which the entire compliance structure is built. It is a systematic process of identifying, cataloging, and documenting all the personal data an organization collects, stores, uses, shares, and disposes of in the course of its operations. Without this detailed inventory, any attempt to comply with the law becomes guesswork, prone to serious failures and exposed to administrative sanctions.

In practice, data mapping answers some basic questions. What personal data does the organization process? Whose data is it? For what purpose is it collected? Where is it stored? Who has access to it? How long is it kept? Is it shared with third parties? The answers make up what the law calls the Record of Processing Operations, expressly required by Article 37 of the LGPD. That article obligates both the controller and the operator to keep this record, especially when the processing is based on legitimate interest.

We have seen that many organizations underestimate how complex this process is. Mid-sized companies often handle personal data in dozens of different systems, from internal spreadsheets and enterprise management software to digital marketing platforms, communication tools, and cloud storage. Personal data travels along paths that are not always obvious to managers, and the purpose of mapping is precisely to make that flow visible and controllable.

The Essential Steps of a Personal Data Inventory

We carry out data mapping through clearly defined steps that ensure the inventory is comprehensive and reliable. The first phase is a survey of business processes. Before looking at the data itself, we need to understand how the organization works: which departments exist, what each one does, which systems and tools it uses, and which workflows involve information about individuals. This survey usually involves interviews with the manager of each area, a review of documents, and observation of day-to-day routines.

The second step is identifying the personal data itself. For each process we map, we catalog the categories of data involved: registration data (name, CPF, address), financial data (banking information, payment history), sensitive data (health information, biometrics, religious beliefs), data about minors, and more. This categorization is essential because the LGPD sets different rules depending on the nature of the data, and the processing of sensitive data is subject to stricter requirements.

In the third step, we document the life cycle of each category of data: how it is collected (online form, paper contract, system integration), where it is stored (local server, cloud, physical file), who has access (user profiles, permission levels), who it is shared with (service providers, business partners, public agencies), what legal basis authorizes the processing, and what retention period applies. Each of these elements must be documented clearly and kept easy to access.

Without an up-to-date data inventory, an organization does not know what it is protecting, cannot respond to data subjects, and is left vulnerable before the National Data Protection Authority.

The fourth step is analyzing the risks tied to each data flow. Once the mapping is complete, we can identify vulnerabilities: data stored without encryption, excessive access by employees who do not need the information to do their jobs, a lack of contracts with operators who process data on the organization’s behalf, and data retained longer than necessary. This risk analysis guides the action plan for correcting noncompliance and setting priorities for information security investments.

Tools and Methodologies for Effective Mapping

There are different ways to carry out data mapping, and the right choice depends on the size of the organization, the complexity of its operations, and the resources available. For smaller companies, well-structured spreadsheets may be enough, as long as they follow a consistent methodology and are kept up to date. Larger organizations usually adopt specialized privacy management platforms that automate part of the process and offer features such as automatic generation of the Record of Processing Activities (ROPA), impact assessments, and compliance dashboards.

Whatever tool you choose, certain elements should appear in any well-run inventory. Each entry should contain, at a minimum: a description of the processing activity, the categories of data subjects involved (customers, employees, suppliers, visitors), the categories of data processed, the specific purpose of the processing, the applicable legal basis (consent, performance of a contract, legal obligation, legitimate interest, and others listed in Article 7 of the LGPD), the storage location, the security measures in place, the third parties with whom the data is shared, and the retention period.

We recommend using standardized questionnaires for interviews with the person responsible for each area. The questions should be direct and avoid excessive technical jargon, so that employees without legal or technology training can provide accurate information. Questions such as “What customer information do you use day to day?”, “Where is that information saved?”, and “Do you share this data with anyone outside the company?” work better than abstract terminology about “personal data processing operations.”

The mapping methodology should also build in update cycles. A data inventory is not a static document. New processes appear, systems are replaced, business partnerships change, and legal bases need to be reassessed. Setting a review schedule (every six months or annually, depending on how fast the business moves) ensures that the mapping keeps reflecting the organization’s reality and that new sources of risk are identified in time.

Common Challenges and How to Overcome Them

In our experience, the biggest obstacle to successful data mapping is not technological but cultural. Many employees see the process as bureaucracy or internal policing, which leads to resistance and incomplete information. To overcome this barrier, senior management must show real commitment to the project, making it clear that LGPD compliance is an institutional priority and that every department’s cooperation is essential.

Another frequent challenge is what is known as “shadow IT”: employees using unofficial tools and systems. Personal data may be handled in personal messaging apps, private cloud storage accounts, spreadsheets saved on personal computers, and other environments outside the control of the information technology department. The mapping needs to identify these practices without creating a punitive atmosphere, guiding employees toward the proper channels for handling data.

Data fragmentation across multiple systems is also a significant challenge. In organizations that have grown through acquisitions or have adopted technology solutions over many years, it is common to find the same data replicated across several databases, in different formats and with different levels of currency. The mapping should identify these redundancies, allowing the organization to consolidate its repositories and reduce its exposure to security incidents.

Finally, it is worth highlighting how hard it can be to map data handled by third parties. When an organization hires service providers who access or process personal data on its behalf (operators, in the terms of the LGPD), the inventory must cover these external flows. Many companies, we find, lack adequate visibility into how their partners handle the data shared with them, which creates both regulatory and reputational risk. Including specific data protection clauses in contracts and conducting periodic due diligence on operators are essential measures.

Data Mapping as a Tool for Ongoing Governance

Far more than a regulatory requirement, a personal data inventory is a strategic governance tool. With a complete and current mapping, an organization can respond quickly to requests from data subjects, who may at any time exercise rights such as access, correction, portability, and deletion of their information. If you do not know where each piece of data is stored, meeting these requests within the legal deadlines becomes nearly impossible.

The mapping is also central to preparing the Data Protection Impact Assessment (RIPD, in Portuguese). The National Data Protection Authority (ANPD) may request this document at any time, especially in situations involving the processing of sensitive data or processing that could create risks to data subjects’ rights. Organizations that keep their inventory current can produce this report much faster and with greater accuracy.

In addition, if a security incident occurs (a leak, unauthorized access, or data loss), the mapping makes it possible to quickly determine which data was affected, which data subjects must be notified, and what the incident’s potential impact is. This ability to respond quickly is one of the factors the ANPD considers when evaluating an organization’s conduct and deciding on any sanctions.

We therefore conclude that data mapping should not be seen as a one-time project with a beginning, middle, and end, but as a permanent data governance practice. Organizations that build mapping into their compliance routines lay a solid foundation for sustainable compliance, reduce their exposure to risk, and show in concrete terms their commitment to protecting the personal data entrusted to them.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.