Field notes · Privacy operations
AI Data Mapping Assistant
This page teaches data mapping the slow way: what counts as a record, how long you keep it, and why the drawing fails before the software does. The assistant below does the fast part. It drafts your map in your browser, and you review every piece.
The question nobody asked the tool
I have read that ticket a hundred times. Not the dropdown-is-broken kind. The do-we-map-the-spreadsheet kind, the is-the-backup-a-system kind, the marketing-wants-to-keep-the-emails-just-in-case kind. The software worked. The mental model underneath it did not.
They were never about the tool. Nobody wrote in to say the dropdown was broken. They wrote in to ask: do I map the spreadsheet? Is the backup a system? Marketing wants to keep the emails just in case; is "just in case" a purpose? The software worked. The mental model underneath it did not.
So here is the distinction, in thirty seconds, because everything below depends on it. The inventory is the list: what personal information you hold, where it sits, why you have it. The map is the drawing: how it moves between those places. You cannot draw the movement before you list the things. Every failed mapping project I have watched tried to draw first, produced a beautiful diagram of nothing, and died in a shared drive.
The conversation everyone skips
Ask a room when customer data gets deleted and someone always answers fast: seven years, finance said so. Ask the same room about backups and watch the confidence drain out. Backups are the retention conversation everyone skips, because you cannot reach into last month's tape and delete one customer without deleting everyone.
The honest answer is less satisfying and more useful. You document the rotation. You let expiry ride the rotation, typically thirty to ninety days, and you write that down in the schedule so that when the CAI asks, the answer is a paragraph, not a shrug.
The simulator below is deliberately boring. Pick a record. It walks through the four stages every record lives through, plus the fifth card nobody draws: the backup copies. Tap any statute chip to read the actual provision behind the range.
The table is the work
Nobody will sell you a retention table, because the table is jurisdiction plus sector plus contract plus context, and anyone selling you a single number is selling you a lawsuit. What you can have instead: ranges, the statute behind each range, and the caveats that change it.
That is what the chips do. Each one names the provision, gives its working language, and links to the official text where one exists. Two of them carry most of the weight in this country. Law 25, article 23, made retention a duty in Quebec: once the purpose is fulfilled, destroy the information or anonymize it. PIPEDA, Schedule 1, clause 4.5, sets the federal floor: keep personal information only as long as necessary, set minimum and maximum periods, destroy what is no longer needed. Neither gives you a number. The number comes from your contracts, your limitation periods, and the CRA's six-year clock, which outlasts almost everything else in the building.
Red pencil: if your retention schedule lists a single fixed period per record with no caveats, it was written by someone who has never met your contracts. Ranges with reasons survive contact with reality. Fixed numbers do not.
A worked example
Café Nord is fictional. The mistakes are not. Walk through it step by step: three collection counters, the systems they feed, the third parties that touch the data, the backups nobody drew, and the destruction at the end that the law actually requires. Use the buttons or the arrow keys.
Export pack
Each file carries its legal framing inside it. A CSV that travels without its caveats becomes somebody's policy by accident.
Everything above teaches. This does. Answer four quick questions, or paste a recipe, and the assistant drafts your data map step by step, in your browser. You review each piece, fix what is wrong, and download the draft Excel. The guide stays open above if you need to check a retention range on the way. When the run finishes, your draft opens in the workspace below, ready for you to arrange by hand.
Privacy: this page loads no third-party scripts. The tool watches its own network activity and shows the count beside this notice: 0 requests sent. The offline bundle is the strongest version of this promise. Download it, disconnect, and the full flow still works with the wifi off. Only the offline bundle claims without qualification that nothing leaves your machine.
Your map workspace
Your draft loads here the moment your assistant run finishes. Drag nodes to arrange them, right-click a node for options, and keep chatting with the assistant to refine the draft.
No draft yet.
Finish a run with the assistant above, confirm the review items, and your map will open here, ready to rearrange.
The part nobody wants to fund
Here is the thread I am leaving open on purpose. Everything above solves the drawing. Nothing above solves the rotting. Six months after the workshop, the spreadsheet has a new column, marketing bought a new tool, and nobody updated the map. I have never seen a company fix this with software. The ones that come close do something unglamorous: they put one human on a recurring calendar invite and give that person the authority to be annoying about it. Everything else is decoration.
The approval the agent could not give itself
Café Nord is still fictional. The mistakes keep happening anyway. Everything in this chapter is invented: the restaurant, the partner, the dates, the digests. The statute is real, and the stamp format comes from spec v0.1.
Friday night, familiar even in fiction. The dining room is full, the phones will not stop, and the ordering agent does what it was built to do: it reads tomorrow's reservation list and looks for a delivery partner to pre-position couriers. It finds one, called VéloExpress, also fictional. One detail matters more than it looks: the partner's dispatch servers live in Ohio.
The agent does the thing the earlier chapters kept begging for. It refuses to move anything and drafts two stamps instead. The first covers sharing the reservation list with a new vendor, consequential action CA-01. The second covers the server-side conversion feed the agent wanted to attach so the partner could "optimize" delivery windows. That one is CA-05, the tracker row. The digests below are illustrative, not computed: nobody burns a real signature to illustrate a point.
- Booking system to agent. Read-only on the reservation list: name, phone, party size, time, pickup zone. The agent already had this access.
- Agent to VéloExpress. Blocked. No stamp exists for this vendor, so no data moves. This is the red line from section 04, drawn before the breach instead of after.
- After the signed stamp. Agent to the partner's courier dispatch API, a US endpoint: name_sha256, party size, pickup window, pickup zone. No phone numbers, no emails. The officer took them out.
- The refused feed. Reservation confirmations to the partner's measurement endpoint: does not happen. The pixel never ships.
s. 18.3, the written contract. Before the first byte moves to a new vendor, the contract is signed: what the partner may do with the list, what it may never do, how it keeps it confidential, how it destroys it at the end. A handshake is not a contract.
s. 17, the cross-border leg. The dispatch dashboard is hosted in the US. Before personal information crosses a border, the assessment of privacy-related factors, the EFVP, is done and filed. No EFVP, no transfer. The assessment is not the contract; the officer files both.
s. 8.1, the trackers. Tracking technology stays deactivated by default and switches on only with express, separate consent. The diners never gave it. Silence is not consent. The OPC priced this exact mistake in 2023, when Home Depot's offline purchase data flowed to Meta without proper consent. The file number is OPC-2023-001.
{
"stamp_metadata": {
"schema_version": "0.1.0",
"stamp_id": "0193d2e1-0000-7abc-0000-000000000001",
"created_at_utc": "2026-10-28T19:40:00Z",
"expires_at_utc": "2027-01-26T19:40:00Z"
},
"action_declaration": {
"consequential_action_row_id": "CA-01",
"summary": "Share the fictional Café Nord reservation list with the fictional delivery partner VéloExpress for courier dispatch.",
"least_privilege_scope": "act",
"target_system_identifier": "dispatch-api:VELOEXPRESS-FAKE01",
"data_categories_touched": [
"name_sha256",
"party_size",
"pickup_window",
"pickup_zone"
]
},
"cited_authority": {
"corpus_version": "v2026.12.0",
"statute_citations": [
"Law 25 s. 18.3",
"Law 25 s. 17"
],
"enforcement_case_ids": [
"OPC-2023-001",
"OPC-2019-004"
]
},
"execution_binding": {
"execution_parameters": {
"endpoint": "dispatch-api:VELOEXPRESS-FAKE01",
"fields": [
"name_sha256",
"party_size",
"pickup_window",
"pickup_zone"
],
"excluded_fields": [
"phone_number",
"email_address"
],
"dry_run": false
},
"execution_payload_sha256": "fictional-digest-3c1a90be42fd55aa17c2e8d04f9b36c7a51d02e4f6a83b9d1c5e7f08a2b4c6d"
},
"human_view_binding": {
"human_draft_sha256": "fictional-digest-8e7d21aa09c34bb56de90f12a4c68e3b75d01f29384756a1b2c3d4e5f607182",
"bound_approval_digest_sha256": "fictional-digest-44b19c0de2f7a86d53a10c9e8f42b6d7193c05a8e7d2b14f6c38a09d5e1f2b3"
},
"human_signoff": {
"approver_role": "privacy officer designated under Law 25 s. 3.1",
"decision": "modified",
"signed_at_utc": "2026-10-28T20:05:00Z",
"attestation": "Approved with the contact details removed: hashed names, party size, pickup window, and zone only. No transfer until the s. 18.3 contract is signed and the s. 17 EFVP for the US-hosted dispatch leg is filed. Fresh stamp in 90 days."
},
"non_certification_disclaimer": "This stamp is an open evidence format for recording human approvals of agent actions. It is not legal advice, and it is not a movahedi.ca compliance certification."
}Read it like a verifier. The scope is act: the agent may send, but only the fields named, only to the endpoint named, only until the expiry. The data categories are hashed or coarse, never raw values. The attestation carries the modification in plain words.
{
"stamp_metadata": {
"schema_version": "0.1.0",
"stamp_id": "0193d2e1-0000-7abc-0000-000000000002",
"created_at_utc": "2026-10-28T19:40:00Z",
"expires_at_utc": "2027-01-26T19:40:00Z"
},
"action_declaration": {
"consequential_action_row_id": "CA-05",
"summary": "Attach a server-side reservation-confirmation feed to the fictional delivery partner VéloExpress measurement endpoint.",
"least_privilege_scope": "draft",
"target_system_identifier": "tag-manager:GTM-FAKE001",
"data_categories_touched": [
"reservation_event",
"email_sha256"
]
},
"cited_authority": {
"corpus_version": "v2026.12.0",
"statute_citations": [
"Law 25 s. 8.1",
"Law 25 s. 12"
],
"enforcement_case_ids": [
"OPC-2023-001",
"CAI-INTERFACES-TRUQUEES"
]
},
"execution_binding": {
"execution_parameters": {
"container_id": "GTM-FAKE001",
"feed": "server-side reservation confirmations",
"destinations": [
"partner measurement endpoint (third party)"
],
"dry_run": true
},
"execution_payload_sha256": "fictional-digest-91f04c2bd7a83e56a10d9c4b2e87f6a531d0c4b9e8f7a23d5c10b6e4f8a92d"
},
"human_view_binding": {
"human_draft_sha256": "fictional-digest-20aa17c8f493bd7e65d102a9f84c3b6e5710d2f84a6c9e1b3d5f708293a4c5",
"bound_approval_digest_sha256": "fictional-digest-67d3e8a1b90c4f52e817d3a6f0b59c2e84a1d7f30c6b95e4a2d18c3f7b6e20"
},
"human_signoff": {
"approver_role": "privacy officer designated under Law 25 s. 3.1",
"decision": "rejected",
"signed_at_utc": "2026-10-28T20:05:00Z",
"attestation": "Rejected. Tracking technology requires express opt-in under Law 25 s. 8.1, and the diners never gave it. The feed is also a secondary use under s. 12. Propose it again after consent, or do not propose it at all."
},
"non_certification_disclaimer": "This stamp is an open evidence format for recording human approvals of agent actions. It is not legal advice, and it is not a movahedi.ca compliance certification."
}This is the refusal. A rejected stamp is not a failure of the system; it is the system working. The agent proposed, the officer said no, and the no is on the record in the same format as every yes.
Red pencil: the stamp records the approval. It does not create the consent. A signed stamp on the sharing leg says the officer agreed; it says nothing about whether the diners did. Those are two different permissions, and only one of them lives in this chapter.
One thread stays open, on purpose. The partner's couriers will learn to read the pickup windows and profile delivery times. Nobody drafted a stamp for that secondary use yet. It will need one.