How Do I Make a Data Map for My Small Business?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

A data map is one table that lists every kind of personal information your business collects, why you need it, where it’s stored, who can see it, who you share it with, how long you keep it, how you delete it, and whether you need consent. The Federal Trade Commission (FTC) says the first step in protecting personal information is to take stock of what you have and where it lives. You can’t protect, delete, or explain what you don’t know you have.

Why it matters

Small businesses collect more personal data than they think: web forms, booking tools, texts, email, a customer relationship management (CRM) system, payment apps, spreadsheets, phone photos, and paper files. Each one is a place data can leak. A data map shows you what to protect first, what to stop collecting, and what to delete. It also gives you a fast start if something goes wrong (see 11.9.4 Data Breach Response, which covers outline line 11.5.9).

Made-up example: Lakeside Dog Grooming makes its data map in a spreadsheet. It finds customer phone numbers in 5 places: the booking app, the groomer’s personal phone, a paper sign-in sheet, the email inbox, and an old spreadsheet. It moves everything to the booking app, shreds the sheets, and deletes the old file.

11.5.1 Collected data

What it means: Every type of personal information you collect about customers, employees, vendors, and payments.

How to do it: Make one row per data type: name, phone, email, address, photos of homes, payment details, employee tax forms, vendor bank details, and so on. The FTC suggests checking every computer, laptop, phone, flash drive, and file cabinet, and tracing how data comes in, like web forms, email, mail, and in person.

Common mistake: Forgetting staff phones, where customer photos and texts pile up.

11.5.2 Purpose

What it means: Why you need each data type.

How to do it: Write one plain reason per row, like “Address: needed to do the job and send the invoice.” If you can’t name a reason, stop collecting it (see 11.6.1 Data Minimization).

Common mistake: “We might need it someday.”

11.5.3 Storage location

What it means: Every system, device, file, inbox, database, and vendor that holds each data type.

How to do it: List every place, including backups and paper. Name the vendor for each software tool.

Common mistake: Listing only the main system and missing exports, downloads, and email attachments.

11.5.4 Access

What it means: Who can view, edit, export, or delete each data type.

How to do it: List people and roles for each location. The FTC recommends giving each person access only to what their job needs (see 11.7.6 Least Privilege Access and 11.7.5 Access Inventory).

Common mistake: Everyone logs in as the owner, so you can’t tell who did what.

What it means: Every vendor, partner, contractor, and agency that gets your data.

How to do it: List each one, what they receive, and why. Check their contract terms (see 11.2.7 Data-Processing Terms). The FTC says to check a contractor’s security before you share and put expectations in writing.

Common mistake: Forgetting the marketing agency, bookkeeper, or call answering service.

11.5.6 Retention

What it means: How long you keep each data type.

How to do it: Set a period for each row based on legal requirements and real business need (see 9.8.2 Record Retention Periods). Tax and employment records have required periods. Many other records don’t need to be kept forever.

Common mistake: Keeping everything forever because nobody decided otherwise.

11.5.7 Deletion

What it means: How you securely delete each data type when the time is up.

How to do it: Write the method for each location: shred paper, use wipe tools for drives, and use each software tool’s delete function. The FTC says simply deleting files isn’t enough for old devices (see 9.8.5 Secure Record Destruction).

Common mistake: Selling or recycling an old laptop or phone without wiping it.

What it means: Where you need permission to collect or use data, and how you record it.

How to do it: Mark rows that need consent, like marketing texts, marketing emails, call recording, and customer photos. Record how and when consent was given (see 12.6 Communication Consent Records and 11.1.12 Photo Permission). Consent rules vary by state and by channel.

Common mistake: Using customer phone numbers for marketing texts when they only gave the number for scheduling.

When to get help from a pro

Privacy attorney: if you handle health, financial, or children’s data, sell online in many states, or have a large customer list. Questions to ask:

Which state privacy laws apply to my business, based on where my customers live and how many I have?
What retention periods apply to my records?
Does my privacy notice match my data map?

Bill’s note

[Bill: add a short note. For example, the surprising places you found client data when you mapped SiteSmarty’s systems, or why you think every small business should do this before buying new software.]

If you’d rather have help with this, SiteSmarty can review the forms and tools on your website that collect customer information.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: building the SiteSmarty data map row by row]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the data map spreadsheet]
[Result so far:]

Questions people ask

What is a data map? A table showing what personal information you have, why, where it’s stored, who can see it, who gets it, how long you keep it, how you delete it, and whether consent is needed.

Do small businesses need one? There’s no single federal rule that requires every small business to keep one. But the FTC’s first step for protecting data is to take stock of what you have, and some laws and contracts expect you to know where your data lives.

How often should I update it? Whenever you add a tool, vendor, or form, and at least once a year.

Can I use a spreadsheet? Yes. One row per data type, one column per question on this page, works well.

Audit check

Line	Question	Pass looks like	Fail looks like	Evidence to collect
11.5.1 Collected data	Is every type of personal data listed?	One row per data type across customers, staff, vendors, and payments	Only customer names and emails listed	Data map
11.5.2 Purpose	Does each data type have a written reason?	A plain purpose for every row	Blank or “just in case”	Data map
11.5.3 Storage location	Is every place the data is stored listed?	Systems, devices, inboxes, paper, and backups	Main system only	Data map, system list
11.5.4 Access	Is it clear who can view, edit, export, or delete?	Named people or roles per location	Shared owner login	Data map, access inventory
11.5.5 Sharing	Is every vendor or partner that receives data listed?	Each recipient, what they get, and contract terms	Agencies and contractors missing	Data map, vendor contracts
11.5.6 Retention	Does each data type have a retention period?	A period for each row, matched to legal needs	Keep forever	Data map, retention schedule
11.5.7 Deletion	Is there a secure deletion method for each location?	Shred, wipe, or delete steps written down	Files deleted but devices not wiped	Data map, destruction records
11.5.8 Consent	Are consent needs marked and records kept?	Consent rows marked with how and when consent is captured	Marketing to contacts with no consent record	Data map, consent records

Where this fits

Do this first: 11.1.10 Privacy Notice, 11.2.7 Data-Processing Terms, 11.7.5 Access Inventory

Do this next: 11.6.1 Data Minimization

Sources

Federal Trade Commission, "Protecting Personal Information: A Guide for Business" (checked October 17, 2026)
Federal Trade Commission, "Start with Security: A Guide for Business" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.