Home / Commons / Data map

Tool

Know what personal data you hold.

What you hold, about whom, where it lives, who can see it and how long you keep it, on one register. Print it, or download it as a spreadsheet.

FreeNo sign-upNothing leaves your browserExports to CSV

This tool needs JavaScript, which is turned off. Below is the blank register instead: print it with your browser’s Print command and fill it in by hand.

Free, no sign-up. Nothing you type leaves your browser. Your register is saved in this browser only. Describe kinds of data, never paste real people’s details into it.

01About this register
02What you hold

One record for each kind of personal data, for each purpose: for example “client case notes”, “donor bank details”, “staff payroll”, “volunteer emergency contacts”. Walk through each team and each system.

Your register

Fills in as you type.

Register of personal data

Organization:

Completed by
Updated
Personal dataWhere, and who sees itKept forLegal basis and notes

Review this register when you start a new activity, buy a new system or change who you share data with.

Made with the free data map at moraph.org/commons/data-map. General information, not legal advice.

Tip: print in landscape. The spreadsheet opens in Excel, Numbers, Google Sheets or LibreOffice.

Why it matters

You can’t protect, delete or explain what you can’t find.

A data map is the starting point for almost every privacy duty: answering a request from someone to see their data, telling people what you do with it, deleting what you no longer need, and working out who to tell after a breach.

  • Follow the data. Ask each team what they collect, where it is typed in, where copies end up (spreadsheets, email attachments, paper files) and who outside the organization receives it.
  • Set a retention period for every record. “Forever” is rarely the right answer, and what you no longer hold cannot leak.
  • Legal basis. Under the UK GDPR and the EU GDPR, every use of personal data needs one of six lawful bases (the options in the form); sensitive (“special category”) data needs an extra condition. Other countries’ laws work differently: see privacy duties, country by country.
  • Record keeping can be a legal duty. Under Article 30 of the UK GDPR, organizations must document their processing activities. The UK regulator, the ICO, explains that organizations with fewer than 250 employees need only record processing that is not occasional, is likely to result in a risk to people, or involves special category or criminal offence data. For most charities and clinics, their core work meets at least one of those tests.

General information, not legal advice. The ICO’s own guidance and templates are listed below.

Sources

Where this comes from.

Primary sources only: standards bodies, governments, regulators and the services themselves. Each was opened and checked on 18 October 2026. If something here no longer matches the source, the source wins; please tell us at hello@moraph.org.

Last reviewed October 2026

  1. ICODocumentation (records of processing activities)ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation
  2. ICOWho needs to document their processing activities?ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/who-needs-to-document-their-processing-activities
  3. ICOLawful basis for processingico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis

Need help with privacy duties?

Pro Bono can help an eligible organization map its data, set retention periods and write a plain-English privacy notice.

Apply for Pro Bono