Data mapping

Copyright © 2025 LexisNexis

Data mapping (finding out what personal data your organisation processes) is often cited as one of the first tasks to tackle in a data protection compliance plan.

Assimilated Regulation (EU) 2016/679, the UK General Data Protection Regulation (UK GDPR) requires data controllers and processors to have a written record of data processing activities and the records must be made available to the supervisory authority on request.

Data mapping can be an enormous and time-consuming task. Despite the challenges, understanding and documenting the purposes of processing, the processing that takes place and the data involved provides a great basis for UK GDPR compliance.

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Existing user? Sign-in TAKE A FREE TRIAL
Powered by Lexis+®
Latest Risk & Compliance News

Bennett Verby faces 2027 trial over first UK failure to prevent tax evasion case

MLex: Bennett Verby, an accounting firm in the north of England, faces a trial in September 2027 over allegations that it failed to prevent tax evasion, in the first prosecution of the offence in the UK. Representatives for the company appeared at a court in Manchester on 7 August 2025.

Government publishes report on how to improve gender pay equality in the workplace

The Office for Equality and Opportunity and Women and Equalities Unit have published a report by the Behavioural Insights Team into evidence-based actions for employers to reduce the gender pay gap and improve gender equality in the workplace. This replaces the last report, published in 2021. The statutory guidance for employers on gender pay gap reporting has been updated to refer to the updated report.

Risk & Compliance weekly highlights—7 August 2025

This week's edition of Risk & Compliance weekly highlights includes: updated guidance from DBT and OFSI on Russian sanctions enforcement and breach assessments, a £300,000 penalty for a sanctions violation, and the UK Supreme Court’s stance on government discretion in foreign affairs sanctions policy. The ICO released new data protection guidance on secure document disclosure, while the European Commission and Parliament addressed AI compliance under the AI Act and generative AI copyright concerns.

OFSI extends General Licence INT/2022/2085212

The Office of Financial Sanctions Implementation (OFSI) and HM Treasury (HMT) have extended  General Licence INT/2022/2085212, regarding sanctioned Russian banks for Mongolian energy payments. The licence, effective from 7 August 2025, has been extended to expire at 23:59 on 14 August 2027.

View Risk & Compliance by content type :  
News
Practice notes
Precedents
Q&As

Popular documents

Can a limited company make a subject access request? Can a director of a limited company ask for

Can a limited company make a subject access request? Can a director of a limited company ask for recordings of calls with us? If yes, what personal data must we provide?This Q&A draws on the Information Commissioner’s Office’s (ICO’s) guidance on business-to-business marketing, which may or may

Late payment penalties—inheritance tax

Late payment penalties—inheritance taxWhile interest often accrues on overdue tax, the late payment of certain taxes may also attract a penalty. For information on the interest accruing on overdue tax, see Practice Notes: IHT—payment deadlines on death—Interest on IHT and Interest on late paid

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal fees, will that count as a PET against their estate?A disclaimer is the refusal of a gift prior to acceptance. The refusal of the gift must take place before the beneficiary accepts any benefit

Contributory negligence in personal injury claims

Contributory negligence in personal injury claimsContributory negligence is a partial defence which can lead to a discount in damages.Other defences may also be relevant. See Practice Notes: Did the claimant consent to the risk of injury? and Was the claimant involved in an illegal activity?If a
Can a limited company make a subject access request? Can a director of a limited company ask for

Can a limited company make a subject access request? Can a director of a limited company ask for

Can a limited company make a subject access request? Can a director of a limited company ask for recordings of calls with us? If yes, what personal data must we provide?This Q&A draws on the Information Commissioner’s Office’s (ICO’s) guidance on business-to-business marketing, which may or may

Late payment penalties—inheritance tax

Late payment penalties—inheritance tax

Late payment penalties—inheritance taxWhile interest often accrues on overdue tax, the late payment of certain taxes may also attract a penalty. For information on the interest accruing on overdue tax, see Practice Notes: IHT—payment deadlines on death—Interest on IHT and Interest on late paid

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal fees, will that count as a PET against their estate?A disclaimer is the refusal of a gift prior to acceptance. The refusal of the gift must take place before the beneficiary accepts any benefit

Contributory negligence in personal injury claims

Contributory negligence in personal injury claims

Contributory negligence in personal injury claimsContributory negligence is a partial defence which can lead to a discount in damages.Other defences may also be relevant. See Practice Notes: Did the claimant consent to the risk of injury? and Was the claimant involved in an illegal activity?If a