Data Discovery & PII Mapping
Automated discovery of all personal data across databases, cloud storage, and SaaS tools — delivered as an Article 30 Records of Processing Activities (RoPA) data map.
Automated discovery of personal data across all your data stores: databases, S3/GCS, SaaS integrations, and logs. Delivered as a structured PII inventory and Article 30 RoPA data map within 7–10 business days. Fixed price €1,100–1,800.
📋Why this service exists
Article 30 requires a Register of Processing Activities documenting where personal data lives, who processes it, and for what purpose. Most organizations discover they have PII in unexpected places — this service finds them all.
What you get
- Complete PII inventory (data type, location, sensitivity)
- Article 30 RoPA structured data map
- Data flow diagram (who sends what where)
- Classification by sensitivity (standard / special category)
- List of orphaned/stale PII data stores
- Recommendations report
How we deliver
- Day 0You request quote → reply in 4 business hours
- Day 1–2Discovery call & scope clarification
- Day 3–5Contract signed, kickoff scheduled
- Day 5–7Implementation begins
- Day NFinal deliverables + walkthrough call
- +30 daysFree post-delivery support
Tools & technologies
Prerequisites
- Read access to database schemas (not data)
- List of SaaS tools that receive personal data
- Cloud console read-only access
Pricing
✓ Within scope:
- •Up to 5 databases (PostgreSQL, MySQL, MongoDB, etc.)
- •AWS S3 or GCP Cloud Storage (one bucket namespace)
- •Up to 10 SaaS integrations
⚠ Outside scope (additional quote required):
- •More than 5 databases (additional quote per cluster)
- •On-premises legacy databases without API access
- •Legal review of the RoPA document
📋Final price confirmed in proposal within 4 hours of your request.
Realistic timeline — what to expect
- T+0hSubmit request
- T+4hInitial proposal (business hours)
- T+1–3dDiscovery call
- T+2–3dFinal invoice
- T+3–5dContract signed
- T+4–6dPayment received
- T+5–7dService kickoff
- T+5–7d+NService complete
Frequently asked questions
Do you read the actual personal data?
What if we use many microservices?
Does this produce a GDPR-ready Article 30 register?
Related services
GDPR Technical Gap Assessment
2–3 week engineering audit of your infrastructure against GDPR Article 32. 20-page executive report with prioritized findings and 90-day remediation roadmap.
Data Retention Automation (Article 5(1)(e))
Implement automated data retention policies: automatically delete or archive personal data when the retention period expires, across databases, file storage, and logs.
Right to Erasure Automation (Article 17)
Build an automated pipeline that finds and erases all personal data for a given data subject across all systems within 30 days of request.