Data mapping for privacy compliance that doubles as data licensing prep

What a privacy data map is, and why it doubles as licensing prep

A privacy data map is a system-by-system register of the personal information a company holds: which categories sit in each system, who owns that system, why the data is kept and how long it stays. Add two columns, how many years of history each system holds and how it can be exported, and the same spreadsheet answers most of the data inventory a company completes when it explores licensing its records through SourceX.

Privacy teams call the document a data map, a data inventory or, where European rules apply, a record of processing activities (ROPA). Owners usually start one because something forces the issue: a California privacy deadline, an enterprise customer's security questionnaire, a cyber insurance renewal or an acquirer's diligence request list.

The licensing inventory asks overlapping questions for a different reason. After a company qualifies, it lists each system, the record types inside, the years covered and the export route, so that scope, redaction and price can be discussed. The inventory describes records; it does not contain them. If the licensing model is new to you, what data licensing for AI means explains how a license differs from a sale.

Which privacy rules make a data map worth building now?

Two rule sets push US companies toward a map, and sector rules add more on top.

• California. The California Privacy Protection Agency's regulations page lists CCPA regulations effective January 1, 2026, plus a package on risk assessments, cybersecurity audits and automated decisionmaking technology, with some compliance deadlines phased in from 2027 to 2028. A business cannot assess the risk of processing it has not located.
• Europe. The GDPR has applied since 25 May 2018 and can reach organizations outside the EU that offer goods or services to people in the EU or monitor their behavior. A US company with European customers, users or staff may already need a processing record.
• Sector and transfer rules. Health, financial and call recording rules sit on top. If the map turns up large volumes of sensitive data about US persons, the guide to the DOJ bulk sensitive data rule covers the limits it places on licensing US personal data.

Rules and deadlines change, so check the current text with counsel. This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

What you need before you start

Gather these before the first interview, so department heads answer questions instead of hunting for documents:

• A named owner with authority across departments, often the CFO, COO or head of IT.
• Every software subscription from accounts payable or the general ledger for the last two to three years, plus the single sign-on app list.
• Names of systems retired in the last decade, and where their archives went.
• The current external privacy policy, the employee handbook and any records retention schedule.
• Master service agreements and data processing addenda with clients, especially clauses on secondary use.
• Thirty to sixty minutes with each department head: sales, support, finance, HR, engineering and operations.

How to build the map in eight steps

1. Start from the money trail. Software spend finds systems that interviews miss. Merge the accounts payable list with the sign-on list and add retired platforms; strong licensing candidates often run 10-15 or more systems.
2. Record categories per system. For each row, note the personal information present: identifiers, contact details, employment and payroll data, message content, call audio, financial account data, government ID numbers and health information.
3. Name an owner and a purpose. One accountable person per system, plus a plain-language reason the data exists, such as billing, support, payroll or delivery scheduling.
4. Capture retention as it really is. Write down the policy period and the date of the oldest record still present. The gap between the two is a finding in its own right.
5. List recipients. Vendors, processors, affiliates and clients that receive or own the data. Mark rows where the company holds records on a client's behalf.
6. Add the two licensing columns. Years of history, oldest to newest record, and export route: native export, admin API, vendor request or backup restore.
7. Add a rights column. Note who created the content. The Copyright Office's Circular 30 on works made for hire explains that work employees prepare within the scope of their jobs generally belongs to the employer, while commissioned work from contractors may not unless it fits the statutory categories and a signed writing says so.
8. Flag restricted rows, then date the map. Mark health information, payment card data, government IDs, privileged legal threads and client-owned data, assign a refresh owner and put the date on the file.

How privacy map columns line up with a licensing inventory

Once the privacy map exists, the data inventory builder helps list systems and records in a licensing-friendly layout.

Common mistakes

Call recordings deserve their own pass; the call recording compliance checklist covers consent and notice history year by year.

Example: one map, two uses (Illustrative)

Illustrative and fictional: a 140-employee freight brokerage in the Midwest started a data map after an enterprise shipper sent a security questionnaire. The CFO pulled three years of software spend and found 17 systems, including a ticketing tool the company had left in 2021 whose archive still sat in cloud storage.

The map flagged three issues: driver settlement files containing Social Security numbers, two shipper contracts that barred secondary use of shipment data, and a shared mailbox mixing personal and business mail. A year later the owner considered licensing. The inventory reused the existing rows, added history and export columns, and carried the three flags forward as exclusions. Nothing new had to be discovered; it only had to be written in a second format.

What this means if you introduce companies

For an advisor, a company that has just finished a data map is a strong lead. It already knows its systems, owners and history, which are the facts qualification asks about. The baseline is a US company with 50+ full-time employees at peak (contractors excluded), several years of documented operations, rights to license its records and an authorized sponsor such as the owner, CEO or CFO.

Never ask to see the map. A partner makes the introduction and passes on basic fit information only; the company completes its own inventory with SourceX, and redaction and de-identification requirements are settled with the company before any work starts. Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, paid only after the buyer pays and SourceX receives its fee. The full sequence is on how it works.

Next step

If you advise a company that has a privacy map, or is building one, register as a partner and make the introduction, or point the owner to sourcex.si/apply to apply directly.