Use case
GDPR data mapping diagrams
Systems, data categories, processors, and transfers on one map: the picture behind your records of processing.
Scenario
A privacy lead and a platform engineer are preparing the yearly review of processing activities: a web signup, a CRM, a support desk, an analytics warehouse, two external processors, and one transfer to a region outside the EU.
Draw the systems that hold personal data, label each flow with the categories it carries, and frame processors and regions. Revision snapshots keep the history of the map between reviews. Share a branded public link or export SVG/PNG; Pro adds embed and watermark-free PDF/JPEG.
What you draw
GDPR data mapping diagrams
- Systems and external processors as C4 Software System and External System nodes
- Databases, queues, and the warehouse that store personal data
- Edges labelled with data categories and purpose
- Region and boundary frames for where data lives and crosses borders
- Security nodes for the vault, identity provider, and access policies
- A Table node for retention and lawful basis per system
Why Archboard
Archboard is a hosted diagram workspace where privacy and engineering draw one map instead of a spreadsheet next to a stale architecture slide. Data, Security, C4, and Cloud nodes sit on the same canvas, and revision snapshots show how the map changed between reviews.
Packs on this canvas
Data · Security · C4 · Cloud
Every built-in pack is on Free (3 diagrams, 15 diagram nodes + 150 notes, text, stickers & mind map topics each, branded public share, live editing with your AI agents). Pro adds unlimited diagrams and nodes, seats for teammates to edit live, embed, and watermark-free export ($10/seat/month).
Scope
Archboard helps you draw and document a data map; it is not legal advice and does not decide your lawful basis or write your records of processing. There is no dedicated privacy symbol set yet; today the map is drawn with Data, Security, C4, and Cloud nodes, and your privacy lead or counsel still reviews it.
How a session goes
Start from the template or a blank canvas after Google or GitHub sign-in
Place the systems that collect, store, and share personal data
Label each flow with data categories, then frame processors and regions
Save a revision for the review and share a live link with your privacy lead
Closest template
Streaming Data Platform
The closest template is the Streaming Data Platform example: event bus, queues, Postgres, warehouse, and object store with the flows between them. Label each flow with the personal data it carries and frame the processors.
Opens an editable copy in your workspace. New to Archboard? Sign in with Google or GitHub and the copy opens right after.
A data map the whole team can read
Most data maps start as a spreadsheet: one row per processing activity, columns for categories, purposes, and retention. The spreadsheet answers what, but nobody can see where: which system collects the email address, which queue carries it, which processor receives it, and where it crosses a border. A GDPR data mapping diagram puts the where on the page. Systems and processors become nodes, flows become labelled edges, and regions become frames, so privacy and engineering point at the same picture when they ask where personal data goes.
Start at the edges of the organization: the forms, apps, and imports where personal data enters. Follow each flow inward through the services, databases, and queues that store or move it, and outward to the processors that receive it, such as email, support, analytics, and payments. Label every edge with the data categories and the purpose it serves, and frame the systems by region so transfers outside the EU are visible at a glance. A Table node next to each system can carry retention and lawful basis as your team decides them.
From data map to review
A data map is only useful if it stays current between reviews. Save a revision snapshot when the review closes, so next year starts from a known shape instead of a blank page, and share a branded public link with the people who answer the questions: engineering for systems, the privacy lead for purposes. Export SVG or PNG for the review pack, and export structured JSON when the map itself has to travel. Pro adds embed for the privacy wiki plus watermark-free PDF and JPEG.
Archboard helps you draw and document the map; it is not legal advice, and it does not decide your lawful basis or write your records of processing for you. There is no dedicated privacy symbol set yet; Data, Security, C4, and Cloud nodes cover systems, stores, processors, and regions today. Sign in with Google or GitHub, start from the closest template, and draw the flows of personal data your team owns.
Open a published example
- Streaming Data PlatformEvent bus, queues, Postgres, warehouse, and object store. Label each flow with the personal data it carries.
- C4 Container ViewPerson, systems, containers, and database that form the system context behind a processing activity.
- Multi-Region Cloud HARegions and managed databases that show where data lives and where it crosses borders.
Questions
Does Archboard replace our records of processing?
No. Archboard is a diagram workspace for the map behind your records; the records themselves, your lawful basis, and the final review stay with your privacy lead, DPO, or counsel.
Is there a dedicated GDPR or privacy symbol set?
Not yet. Today data maps are drawn with Data, Security, C4, and Cloud nodes, with labelled edges for data categories and frames for regions. The closest template opens a data platform you can relabel.
Who should own the data map?
Usually privacy and engineering together: privacy owns purposes and categories, engineering owns systems and flows. One shared canvas with revision history keeps both views in the same file.
Open a canvas in a minute
Sign in with Google or GitHub. Free for a single seat. Upgrade when the team joins.