Do you know what data your business holds? Map it in an hour.

When Bristol City Council found its schools platform had been attacked, the hardest question took weeks to answer: whose data was taken? Data mapping is how you answer that question for your own business before you ever need to. It’s a simple list of the systems you use, what personal data sits in each one and who can get to it. A first version takes about an hour, and a spreadsheet is fine.

This guide walks you through it step by step, with a template you can copy.

Why it’s worth an hour

• Breaches have a 72-hour clock. If a breach is likely to put people at risk, you normally have 72 hours from becoming aware of it to report it to the ICO. You can’t say what was affected if you don’t know what was there.
• You probably need a record anyway. UK GDPR expects businesses to keep a record of how they use personal data. There’s a limited exemption for organisations with fewer than 250 staff, but it doesn’t cover regular processing such as payroll and HR, so most businesses need at least a basic record.
• It shows you what to protect first. Once you can see where the sensitive data lives, it’s obvious which systems need multi-factor authentication, tighter access and better backups first.
• Customers and auditors ask for it. Supplier security questionnaires and ISO 27001 both expect you to know what information you hold and where.

What you’ll need

• A spreadsheet (Excel or Google Sheets is fine)
• An hour, ideally with whoever looks after payroll, HR and IT
• Your list of software subscriptions, or last month’s card statement, to jog your memory

Step 1: List your systems

Start with the places that hold information about people. Most businesses find 10 to 20. Work through these in order:

1. People: payroll, HR system, pension provider, recruitment inbox
2. Money: accounting software, bank, card payments
3. Customers: CRM, booking or ordering system, website forms, mailing list
4. Everyday tools: email, shared drives such as OneDrive, SharePoint or Google Drive, messaging apps
5. Outside help: anything a supplier runs for you, such as your IT provider, accountant or marketing agency
6. Paper and devices: filing cabinets, old laptops, USB drives and that box of CVs in the cupboard

Your card statement is the best memory aid. Every monthly subscription is a system that might hold personal data.

Step 2: Answer six questions for each one

Give each system a row and these columns:

Column	What to write	Example (payroll)
Whose data	Staff, customers, suppliers, children, patients	Staff and ex-staff
What data	The types, not the records	Names, addresses, bank details, NI numbers, salaries, sick pay
How many people	A rough number	About 40
Who can get in	Names or roles, including suppliers	Finance manager, MD, payroll bureau
Where it lives	Cloud service, supplier, office, country	Cloud payroll software, UK hosted
How long you keep it	Your rule, or “not sure”	6 years after leaving

“Not sure” is a perfectly good answer for a first pass. It shows you where to look next.

Step 3: Flag the sensitive stuff

Add a column called Sensitive? and mark any system holding:

• Health information, including sick notes and occupational health
• Information about children
• Bank details, card numbers or ID documents such as passports
• Criminal records checks
• Anything else that would really hurt someone if it leaked

These are the systems to protect first, and the ones where a breach is most likely to need reporting.

Step 4: Tidy as you go

Mapping almost always turns up a few quick wins. Fix them while they’re in front of you:

• Remove anyone who has left from the “who can get in” list. Our leaver checklist covers the rest.
• Turn on multi-factor authentication for every system you’ve flagged as sensitive.
• Delete data you no longer need, such as old CVs, exports sitting in someone’s downloads folder and systems you stopped using.
• Check who has admin rights. In Microsoft 365, our 15-minute admin check shows you how.

Step 5: Add a breach contact for each supplier

Add one more column: Who tells us if it’s breached? For each supplier, note who you’d contact and whether their contract says how quickly they’ll tell you. If you can’t find it, ask them. It’s a normal question and a good supplier will have an answer ready.

Step 6: Keep it alive

A data map is only useful if it’s roughly right. Two simple habits keep it that way:

• Add a row whenever you sign up for something new that holds personal data.
• Review it every three months, or put it on the agenda when you renew Cyber Essentials.

Store it somewhere you can still reach if your main systems are down, such as a printed copy or a file outside your usual drive. On the day of an incident, that’s when you’ll need it most.

Your one-hour checklist

• List every system that holds personal data, using your card statement as a prompt
• Fill in whose data, what data, how many, who can get in, where and how long
• Flag anything sensitive
• Remove leavers, turn on MFA for sensitive systems and delete what you don’t need
• Note who each supplier would tell you about a breach
• Save a copy somewhere you can reach in an emergency and set a three-month reminder

FAQ

Do I legally need a data map?

UK GDPR doesn’t use the words “data map”, but it does expect most businesses to keep a record of how they use personal data. A data map like this one gives you most of what that record needs. The ICO has free templates if you want to go further.

Is a spreadsheet really good enough?

Yes. For most businesses a spreadsheet is the right tool. What matters is that it’s accurate, someone owns it and you can find it in a hurry.

How does this help if we have a breach?

It tells you straight away which people and which types of data might be affected, which is exactly what the ICO, your insurer and the people involved will ask. Without it, you’re working that out under pressure.

Does Cyber Essentials need a data map?

No. Cyber Essentials focuses on five technical controls and doesn’t ask for one. ISO 27001 does expect an inventory of your information and assets, so a data map is a good head start if you’re heading that way.