Mapping your data
The price of freedom is eternal vigilance. Don’t store unnecessary data, keep an eye on what’s
happening, and don’t take unnecessary risks. - Chris Bell, former U.S. Congressman
Collecting and storing other people’s information is a privilege and you cannot just collect and
use it without a legal basis. New rules around the world are becoming more and more specific
on what you can collect, how you store it, and what you use the personal data for. Getting a
handle on your data assets early will save you time, money and could potentially save your
business!
Key questions to continually ask yourself:
● What is considered “personal data”?
● What do you need the personal data for (what is the purpose for processing the personal
data)? Do you really need (all) the personal data?
● What is the legal basis for you to process the personal data (i.e. consent, or fulfilling
legal obligation or some other basis)?
● How are you collecting personal data (from the person themselves or do you get the
data from a third party)?
● Where and how long are you storing the personal data?
● Who has access to this personal data?
● How long do you need to retain this personal data for?
Recommended steps to help you start understanding your data assets:
1. Map out all the tools and platforms you use (internal and external / commercial or
custom built)
2. Map out all the stakeholders you have. At this point be as specific as possible (When you
go to aggregate, you can roll up by stakeholder types, but at this stage granularity is
important because there may be different data sets and processes you use for different
subsets of stakeholder).
3. Map out what personal data you are currently collecting
a. What types of data are currently being collected
b. From whom do you collect this personal data (from the person or third party)
c. What you use it for (purpose)
d. Why it is important for your startup
e. How long will you need to and/or can store it
f. With whom do you share this data (i.e. what platform you use, what services of
third parties you use in a way they also are processing the personal data on your
behalf)?
4. Talk to your team and ask open ended questions about their process and whom they
talk to. Ask them to run you through documents or processes they may have. Use this to
confirm what tools and platforms they use and data they are processing.
These documents were produced by Startup Wise Guys and are not to be shared or repurposed
Startup Wise Guys 2021 (c)
5. Use a spreadsheet to track:
a. The purpose of processing
b. The stakeholder group
c. The data you are processing on that group
d. How that data is collected and processed
e. Are you processing personal data through numerous tools or platforms and/or
using third party services?
f. Where that data is stored
g. Why you need this specific data
h. How long you are storing the data for
We get it - this is a hard process, but trust us, if you start when you are small and create good data habits
and hygiene (deleting data when not needed) you will save yourself time and money later!
These documents were produced by Startup Wise Guys and are not to be shared or repurposed
Startup Wise Guys 2021 (c)