The Personal Data Map 2.3A.2-1

Building the Map

The personal data map is a structured inventory of your data environment. It does not require technical expertise. It requires honesty about how much of your life is stored, processed, and accessible through systems you may never have examined.

The map is built in four passes, each addressing a different dimension.

Pass 1 — What data exists. List the categories of data that are generated by your daily activity: communications (email, messaging, calls), financial (banking, payments, investments, tax records), health (medical records, fitness tracking, prescriptions), professional (employment records, credentials, performance data), social (social media accounts, contact lists, group memberships), location (phone location history, transit records, connected vehicle data), and identity (government IDs, biometrics, authentication credentials). Most people undercount. The goal is completeness over precision — capture every category, even if you cannot immediately list every service that holds data in that category.

Pass 2 — Where it is held. For each category, identify the specific institutions, services, and devices that hold the data. Your email provider holds your communications. Your bank holds your financial data. Your phone holds your location history. Your employer holds your professional data. Cloud services hold your backups. Social platforms hold your relationship data. The goal is to make the custody chain visible: for every category, who holds the data, and on whose terms?

Pass 3 — Who can access it. For each institution or service, identify the access perimeter. The custodian's employees may have access. The custodian's partners or data processors may have access. Law enforcement may have access under defined legal conditions. Hackers may have access if the custodian's security is breached. The terms of service may grant the custodian rights to use, analyze, or sell the data. The goal is not paranoia — it is structural awareness of who can see what.

Pass 4 — What would happen if it leaked. For each data category and custodian, assess the consequence of unauthorized disclosure. Some data leaks produce embarrassment. Others produce financial loss, identity theft, professional damage, or physical risk. The consequence assessment determines priority: high-consequence data relationships warrant more protection effort than low-consequence ones.

Using the Map

The completed map is a decision tool, not a permanent document. It serves three functions.

First, it identifies priority exposures — data relationships where the consequence of compromise is high and the current protection is low. These are the first candidates for the four disciplines (minimize, separate, encrypt, selectively disclose).

Second, it identifies forgotten dependencies — institutions and services that hold data you no longer use or have forgotten you provided. Deactivating unused accounts, revoking unnecessary permissions, and requesting data deletion from services you no longer use reduces the attack surface without cost.

Third, it feeds the assumptions register from unit 2.3A.1. Every data relationship in which you trust an institution to protect your data without having verified that institution's governance, security practices, or terms of service is an assumption you are acting on without full verification. The map makes those assumptions visible; the register tracks them.

The map should be reviewed at least annually, or whenever a significant change occurs in your data environment — a new service, a new employer, a data breach notification, or a change in terms of service from an existing custodian.