TruePrivacy Data Mapping builds and maintains your data processing inventory automatically. Know exactly what data you collect, why you process it, where it goes, and who has access — in real time, without spreadsheet archaeology.
Data inventory showing assets, data categories, and processing activities

​
What the data map contains

ObjectDescription
Data assetsEvery system, database, SaaS tool, and file store holding personal data, discovered via integrations or added manually.
Data categoriesThe kinds of personal data in each asset — contact details, identifiers, financial data, special category data.
Processing activitiesWhat you do with the data: purpose, legal basis, recipients, retention period, and responsible owner.
Data flowsHow data moves between assets and out to third parties. See Data Flows.

​
Building the inventory

1

Discover data assets

Connect your systems via integrations. Data discovery scans surface every system holding personal data — including endpoint findings reported in aggregate by the Device Agent.
2

Auto-populate processing records

For each discovered flow, TruePrivacy creates a draft processing activity record pre-filled with data categories, systems involved, and suggested legal bases for your team to confirm.
3

Enrich with business context

Business and legal teams add purposes, retention rules, legal bases, and owners using guided forms — no privacy expertise required.
4

Maintain automatically

Continuous background scanning detects changes — new tables, new integrations, changed flows — and notifies record owners to review and confirm updates.
Assign and manage legal bases — consent, legitimate interest, contract, legal obligation — for every processing activity. TruePrivacy suggests a basis from the processing purpose and data categories (flagging, for example, that consent is required for marketing use of special category data), and records who made the final selection and when. Legitimate interest assessments are embedded directly in the mapping workflow.

​
Retention management

Define retention periods per data category and processing purpose. The system flags data that has exceeded its retention period and triggers automated deletion or review workflows.

​
What the data map powers

RoPA

Article 30 records are generated from the data map automatically.

DSR fulfillment

Request scoping queries the live map to find every system holding a person’s data.

DPIA

New processing activities are evaluated for DPIA triggers as they appear.

Vendor Risk

Outbound flows to third parties feed vendor discovery.