Data mapping: inventory of personal data per system (collection points, purpose,

legal basis, retention, processors/sub-processors, cross-border transfers), data-flow diagram, and classification labels (PII/special-category/derived); identify dark data to delete.