Productivity
Map your data processing
A record of processing and a risk assessment where one is required.
Fill it in
Products, tools and what data flows where.
Where data leaves, and on what basis.
And say why it is or is not.
Your prompt
Map the processing. [the company] Start from where the data actually is, not from the product list. Every company has processing nobody remembers: the analytics tag, the support tool, the spreadsheet on someone's laptop, and the vendor a team signed up for last year. A record built from the org chart misses all of it. For each activity: purpose, lawful basis, categories of person and data, recipients, retention, and where it is stored. Retention is the field everyone leaves as "as long as necessary", which means no policy at all. List international transfers with the mechanism relied on for each. Say which activities need a DPIA and which do not, with the reason. This is a working record, not legal advice.
Use Map your data processingOpens with everything above already filled in.
Why this works
Every company has processing nobody remembers: the analytics tag, the support tool, the spreadsheet on a laptop. A record built from the org chart misses all of it. This starts from where the data actually is, and treats retention as a field that must be answered.