Personal Data Flow Mapping
Knowing what personal data you collect is the easy part. The hard part is knowing where it goes afterwards - and whether you could find every copy if someone asked you to delete it.
Most businesses can name their systems. Almost none can trace one person's record through all of them - the inbox it was forwarded to, the spreadsheet it was exported into, the laptop it was downloaded onto, the vendor it was shared with, the backup that still holds it.
Same law. Different data flows. Different fixes.
Where data mapping fits
Four steps, in order. Each one answers a question the next one depends on.
- 1
Discover
What personal data does your business hold?
Data Discovery - 2
Map
Where does it travel, and where do you lose control of it?
You are here - 3
Assess
How ready are your controls, scored against your sector?
Industry Assessment - 4
Publish
Turn it into a privacy notice you can actually put on your site.
Notice Generator
Not sure what personal data you hold?
Map it in ~3 minutes across 276 business types, then come back for the full assessment.
Available maps
Each map is a reference model of a typical business in that sector - not a scan of your systems. Free, no email required.
Recruitment Agencies
Follow one person's record through 10 stages and 11 outside parties - and see the 7 points where control breaks. Shown for permanent recruitment.
CA Firms
Follow one person's record through 10 stages and 11 outside parties - and see the 7 points where control breaks.
Training Institutes
Follow one person's record through 10 stages and 11 outside parties - and see the 7 points where control breaks. Shown for hybrid institute.
D2C Brands
Follow one person's record through 10 stages and 18 outside parties - and see the 8 points where control breaks. Shown for own website brand.
Clinics & Diagnostic Labs
Follow one person's record through 14 stages and 16 outside parties - and see the 8 points where control breaks. Shown for integrated clinic + diagnostics.
Schools & Colleges
Follow one person's record through 12 stages and 17 outside parties - and see the 8 points where control breaks. Shown for school - k-12.
Law Firms & Legal Consultants
Follow one person's record through 13 stages and 25 outside parties - and see the 8 points where control breaks. Shown for litigation & dispute resolution.
Real Estate & Property Firms
Follow one person's record through 10 stages and 23 outside parties - and see the 8 points where control breaks. Shown for brokerage & property consultancy.
Hotels, Hospitality & Travel
Follow one person's record through 11 stages and 24 outside parties - and see the 8 points where control breaks. Shown for hotel / resort.
Pharmacies & Online Pharmacies
Follow one person's record through 11 stages and 9 outside parties - and see the 8 points where control breaks. Shown for independent retail pharmacy.
Fintech, NBFC & Digital Payments
Follow one person's record through 13 stages and 25 outside parties - and see the 8 points where control breaks. Shown for digital lending / lsp.
Gyms, Salons & Spas
Follow one person's record through 12 stages and 14 outside parties - and see the 8 points where control breaks. Shown for gym / fitness centre.
Need a DPDPA-ready privacy notice?
Generate a tailored Notice Pack — full notice, mini-notices, consent text and a rights block — from a few plain questions.
Legal baseline: DPDP Rules, 2025 notified on 14 November 2025, with phased commencement.
Each map is a reference model of a typical business in that sector, not a scan of your systems. This page is for educational purposes and does not constitute legal advice.