Almost every privacy and security obligation assumes you know what data you hold, where it sits, why you have it and who can see it. For a CRM, that sounds easy until you start asking. The core records are obvious. The surprises are in the custom fields, the attachments, the integrations and the exports that leave the system.

What a data map is for

A data map is a working description of how personal data flows through your CRM. Depending on where you operate, some laws expect a formal record of processing activities, and organisations of certain sizes or types may be required to keep one. Whether you are obliged to or not, the same document helps you answer access requests, assess vendors, respond to incidents, and set retention periods. Confirm which obligations apply to you with a qualified professional, since they vary by jurisdiction.

Think of the map as an operational tool, not a compliance artefact. If nobody uses it to make decisions, it will rot.

Start from the system, then widen

Begin inside the CRM and work outward in three passes.

Pass one: what’s in it. Walk through the objects and fields: contacts, accounts, leads, opportunities, cases, activities, notes, files. For each, note the categories of personal data. Include the free-text fields, because that’s where staff type things like health details, family circumstances or financial difficulties that never belonged there.

Pass two: where it came from. Web forms, imports, event lists, partner referrals, enrichment services, manual entry, email sync. Provenance affects your lawful basis and your obligations to tell people what you hold.

Pass three: where it goes. Integrations, exports, reports shared by email, data warehouses, marketing tools, outsourced support, backups. This pass usually produces the most surprises.

What to record for each activity

Keep the format simple enough that people will maintain it. For each processing activity, such as “managing sales opportunities” or “handling support cases,” capture:

• Purpose and the lawful basis relied on
• Categories of people and categories of data
• Source of the data
• Who has access internally, by role
• Recipients and vendors outside the company
• Locations where data is stored and accessed from
• Retention period and the deletion method
• Main security measures
• Owner, last review date

Resist the urge to record everything at field level in the first version. A reasonable starting point is activity level, with the sensitive or unusual fields listed explicitly.

Who to ask

You can’t build this alone. The admin knows the configuration, but sales, support and marketing know what people actually type and export. Hold short interviews with one person from each function, and ask concrete questions: “What do you copy out of the CRM? Where does it go? What do you keep in your own files?” People will describe workarounds they would not volunteer in a policy review.

A common trap is relying on a questionnaire alone. Answers come back vague, and the shadow processes stay hidden.

Keep it alive

A data map built once and filed away becomes wrong within months. Tie updates to events that already happen:

1. New integrations or marketplace apps require a map entry before approval.
2. New fields that hold personal data go through a short review.
3. Changes in vendor or location trigger an update.
4. An annual review with each owner confirms or corrects their entries.
5. Incident reviews and access requests feed gaps back into the map.

Store it somewhere the right people can edit with version history, not as a spreadsheet emailed around.

A sample structure

Field	Example entry (hypothetical)
Activity	Managing sales opportunities
Purpose and basis	Taking steps to enter a contract at the customer’s request; basis confirmed with adviser
Data categories	Name, work email, phone, job title, deal notes
Source	Web forms, events, direct outreach
Internal access	Sales reps (own records), sales managers (team), admins
External recipients	CRM provider, email delivery vendor
Location	Stated region of hosting; support access noted
Retention	Defined period after last activity, then deletion or anonymisation
Owner and review date	Sales operations lead, reviewed annually

A hypothetical example

A small software company decides to build its first data map. In the CRM walk-through they find that a notes field is used by support to log customers’ personal circumstances when explaining discounts, and that a weekly pipeline report is exported to a shared drive with no access restrictions. Interviews reveal that one salesperson keeps a personal spreadsheet of contacts “for convenience.” None of this appeared in any policy. The map becomes the starting list for fixes: guidance on what belongs in notes, a restricted location for the report, and a decision to retire the spreadsheet. It also gives the company a ready answer when a customer asks what data it holds about them.

Frequently Asked Questions

Is a data map the same as a record of processing activities? They overlap. A record of processing is a formal document some laws require, with specific content. A data map is the broader working view that can feed it. Check with a qualified adviser on what applies to you.

How detailed does it need to be? Detailed enough to answer real questions about purpose, access, sharing and retention. Start at activity level and add field-level detail for sensitive data.

Who should own it? A named person in privacy, compliance or operations, with each activity owned by the relevant business lead. Shared ownership with no name leads to neglect.

Do we need special software? Not to start. A well-structured shared document or table is enough. Dedicated tools may help as you grow.

How does it help with data subject requests? It tells you in advance every place a person’s data can live, so you can search them all instead of discovering a forgotten system halfway through the deadline.

Next Step

Pick one CRM activity, such as managing sales opportunities, and complete a map entry for it this week using the table above. Take it to the sales lead and ask what’s missing. That conversation will tell you how to do the rest.