--- title: "CCPA Checklist: Data Mapping - TrueVault" --- - [CCPA](https://safe.truevault.com/learn/ccpa/what-is-the-ccpa) - [GDPR Compliance](https://safe.truevault.com/gdpr-guide) - [HIPAA](https://safe.truevault.com/learn/hipaa) - [HIPAA Compliance](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [Personally Identifiable Information](https://safe.truevault.com/blog/what-is-pii) - [PHI](https://safe.truevault.com/protected-health-information) - [Resources](https://safe.truevault.com/learn/?hsLang=en) - Login [TrueVault Safe Log in to TrueVault Safe](https://console.truevault.com) [TrueVault Polaris Log in to TrueVault Polaris](https://polaris.truevault.com) - [Resources](https://safe.truevault.com/learn/?hsLang=en) - Login - Login - [TrueVault Safe Log in to TrueVault Safe](https://console.truevault.com) - [TrueVault Polaris Log in to TrueVault Polaris](https://polaris.truevault.com) [CCPA RESOURCES CENTER](https://www.truevault.com/learn/ccpa?hsLang=en) › CCPA COMPLIANCE CHECKLIST # **CCPA Compliance: Data Mapping Checklist** Table of Contents keyboard\_arrow\_right [Overview](https://www.truevault.com/ccpa-checklist?hsLang=en) [Data Mapping Checklist](https://www.truevault.com/ccpa-checklist/data-mapping?hsLang=en) [Vendor Classification Checklist](https://www.truevault.com/ccpa-checklist/vendor-classification?hsLang=en) [Privacy Policy and Notices Checklist](https://www.truevault.com/ccpa-checklist/privacy-policy-and-notices?hsLang=en) [Request Processing Checklist](https://www.truevault.com/ccpa-checklist/request-processing?hsLang=en) [Staying Compliant Checklist](https://www.truevault.com/ccpa-checklist/staying-compliant?hsLang=en) - [Overview](https://www.truevault.com/ccpa-checklist?hsLang=en) - [The Five Major Steps to CCPA Compliance](https://www.truevault.com/ccpa-checklist?hsLang=en#five-steps-to-ccpa-compliance) - [Data Mapping Checklist](https://www.truevault.com/ccpa-checklist/data-mapping?hsLang=en) - [Incoming Personal Information](https://www.truevault.com/ccpa-checklist/data-mapping?hsLang=en#incoming-personal-information) - [Outgoing Personal Information](https://www.truevault.com/ccpa-checklist/data-mapping?hsLang=en#outgoing-personal-information) - [Vendor Classification Checklist](https://www.truevault.com/ccpa-checklist/vendor-classification?hsLang=en) - [Steps for Classifying Individual Vendors](https://www.truevault.com/ccpa-checklist/vendor-classification?hsLang=en#classifying-individual-vendors) - [Privacy Policy and Notices Checklist](https://www.truevault.com/ccpa-checklist/privacy-policy-and-notices?hsLang=en) - [Request Processing Checklist](https://www.truevault.com/ccpa-checklist/request-processing?hsLang=en) - [Right to Know Requests](https://www.truevault.com/ccpa-checklist/request-processing?hsLang=en#right-to-know-requests) - [Right to Delete Requests](https://www.truevault.com/ccpa-checklist/request-processing?hsLang=en#right-to-delete-requests) - [Right to Opt Out Requests](https://www.truevault.com/ccpa-checklist/request-processing?hsLang=en#right-to-opt-out-requests) - [Staying Compliant Checklist](https://www.truevault.com/ccpa-checklist/staying-compliant?hsLang=en) - [Quarterly CCPA Maintenance](https://www.truevault.com/ccpa-checklist/staying-compliant?hsLang=en#quarterly-ccpa-maintenance) - [Annual CCPA Maintenance](https://www.truevault.com/ccpa-checklist/staying-compliant?hsLang=en#annual-ccpa-maintenance) ## Data Mapping Data mapping is the most important step in becoming CCPA compliant, as it forms the foundation for every other part of the process. Here is what you need to do to create a thorough and reliable data map for your business. ### Incoming Personal Information - Review the CCPA's definition of "personal information" The [CCPA’s definition of personal information](https://safe.truevault.com/ccpa-guide/what-is-the-ccpa#what-is-personal-information) is expansive, and businesses often collect more of it than they realize. - Identify all points where personal information is collected Check with every department to understand where they collect information. - Categorize consumer groups By putting consumers into groups, it’s easier to know what personal information is being collected and how it is used. This also helps with responding to privacy requests. - Categorize personal information collected Names, email addresses, transaction history, IP addresses, etc. - Identify business purposes for collecting personal information Sales and marketing, providing goods and services, technical maintenance, etc. - Identify where consumers' personal information is stored This will make it much easier to respond to consumers’ privacy requests. ### Outgoing Personal Information - Review CCPA's definition of "selling" and "sharing" of personal information The law’s [definition of selling personal information](https://safe.truevault.com/ccpa-guide/what-is-the-ccpa#what-is-a-sale) covers many non-monetary transactions, such as receiving a discount on software. Sharing means using personal information for cross-context behavioral advertising (interest-based advertising). - Identify all outside parties to whom you disclose personal information This should cover everything from credit card processors to Google and Facebook. - Categorize outside parties Determine whether they are third parties or [potentially exempted as CCPA service providers or contractors](https://safe.truevault.com/ccpa-guide/what-is-the-ccpa#what-is-a-service-provider), then categorize the parties (IT infrastructure, data analytics, etc.). - Identify the business purpose for disclosing personal information Advertising services, payment processing, etc. - Identify all disclosures which qualify as selling or sharing personal information Every disclosure to third parties should be examined to determine if the business receives some valuable consideration in exchange. Learn more about this in Step 3: Vendor Classification. ### Need help creating your data map? The CCPA’s rules are complex, and businesses are collecting more personal information than ever. TrueVault simplifies the process of data mapping by providing automated, step-by-step guidance from start to finish. Contact our team today. [![Schedule Call](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/4693513/949d85da-b649-4822-b380-0922b22c3b60.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4693513/949d85da-b649-4822-b380-0922b22c3b60) **Disclaimer:** This content is provided for general informational purposes only and does not constitute legal or other professional advice. Without limiting the foregoing, the content may not reflect recent developments in the law, may not be complete, and may not be accurate or relevant in an applicable jurisdiction. This content is not a substitute for obtaining legal advice from a qualified licensed attorney in the applicable jurisdiction. The content is general in nature and may not pertain to specific circumstances, so it should not be used to act or refrain from acting based on it without first obtaining advice from professional counsel qualified in the applicable subject matter and jurisdictions. ### Company - [Blog](https://safe.truevault.com/blog) - [Contact Us](https://safe.truevault.com/contact-us-2019) - [Careers](https://truevault.workable.com) - [HIPAA Compliance Checklist](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [PDF: Developers Guide to HIPAA compliance](https://my.leadpages.net/leadbox/14472b173f72a2%3A131fd12f8b46dc/5760820306771968/) ### Developers - [Patterns](https://safe.truevault.com/patterns) - [Documentation](https://docs.truevault.com/) - [Quick Start Guide](https://safe.truevault.com/quick-start-guide) - [Secure Infrastructure](https://safe.truevault.com/secure-infrastructure) - [API Overview](https://safe.truevault.com/api-overview) ### Latest Posts ### Contact Us 201 Mission Street, 12th Floor San Francisco, CA 94105 Email: [hello@truevault.com](mailto:hello@truevault.com) 2024 © All Rights Reserved.  [Privacy Policy](https://privacy.truevault.com/privacy-policy)  |  [Terms of Use](https://www.truevault.com/legal/truevault-terms-of-use?hsLang=en)  |  [Supplemental Terms](https://www.truevault.com/legal/truevault-supplemental-terms-of-use?hsLang=en) | [California Privacy Notice](https://privacy.truevault.com/privacy-policy#california-privacy-notice)