A GKM Legacy Holdings company · contracting in Maryland, USA · delivering from Accra, Ghana
InsightsWhere we workFrançais
Strategic Advisory
& AI
Book a consultation
A polished stone floor at dusk beside a full-height glass wall. Fine steel lines inlaid in the floor fan out from the lower left: two end at small steel discs inside the room, and others run on under the glass and across a terrace towards the sea. One of the lines that crosses is aqua glass.

flows, retention and open questions

Data mapping template

See where your data goes, and what is unsettled.

Try the map
The film: the map in 25 seconds. An illustrative example on a private school’s data; nothing is registered or sent.
What the film shows, in words
  1. See where your data goes, and what is unsettled.
  2. Four kinds of data. All four are personal data.
  3. 2 leave Ghana: Fee payments (United States), Newsletter list (EU or UK).
  4. 3 questions to settle: how long, under what contract, on what basis.
  5. Keep fee payments in Ghana: 1 leaves. The contract is still a question.
  6. Map it. Then settle what is open.

The demo: the worked example, one change at a time

ExampleA private school’s data (illustrative). A preparation map, not a registration certificate or legal opinion.

Step 1 of 4

Four kinds of data. Two cross the border.

  1. Parents, examination bodyKept: Until age 25
  2. School nurseKept: not set
  3. Payment providerno contractKept: 7 yearsUnited States
  4. Email platformKept: Until unsubscribedEU or UK
  1. Elsewhere in AfricaNo line
  2. EU or UK1 line
  3. United States1 line
  4. OtherNo line
  1. Parents, examination bodyKept: Until age 25
  2. School nurseKept: not set
  3. Payment providerno contractKept: 7 years
  4. Email platformKept: Until unsubscribed
  1. Kept: Until age 25
    Kept: Until age 25
  2. Kept: not set
    Kept: not set
  3. Kept: 7 years
    United StatesKept: 7 years
  4. Kept: Until unsubscribed
    EU or UKKept: Until unsubscribed
Data categories
4
Hold personal data
4
Leave Ghanapersonal-data categories
2
Questions to settleof 6 open, with cautions
3

4 data categories; 4 hold personal data. 2 leave Ghana: Fee payments (United States), Newsletter list (EU or UK). 3 questions to settle, 6 open in all with the cautions.

Press a line
  • Each name and each mark on a line says what the tool raises there.

Now your own data, and where it ends up.

One row per data category. Describe categories, not individuals.

  1. Parents, examination bodyKept: Until age 25
  2. School nurseKept: not set
  3. Payment providerno contractKept: 7 yearsUnited States
  4. Email platformKept: Until unsubscribedEU or UK
  1. Elsewhere in AfricaNo line
  2. EU or UK1 line
  3. United States1 line
  4. OtherNo line
  1. Parents, examination bodyKept: Until age 25
  2. School nurseKept: not set
  3. Payment providerno contractKept: 7 years
  4. Email platformKept: Until unsubscribed
  1. Kept: Until age 25
    Kept: Until age 25
  2. Kept: not set
    Kept: not set
  3. Kept: 7 years
    United StatesKept: 7 years
  4. Kept: Until unsubscribed
    EU or UKKept: Until unsubscribed
Up and Down move between lines. Enter opens a line, Escape leaves it.

A preparation map, not a registration certificate or legal opinion. Confirm requirements with the Data Protection Commission and a qualified adviser.

Data categories
4
Hold personal data
4
Leave Ghanapersonal-data categories
2
Questions to settleof 6 open, with cautions
3

Line 01Pupil records

  • The tool raises no question on this line.
  • Processor contract is marked “Not needed”. The tool takes that on trust.
Line 1 of 4

Data map

  1. 01
  2. 02
  3. 03
  4. 04

Describe categories only; never enter real personal records.

The same map, as a table

Live
4data categories
4hold personal data
2leave Ghana
3questions to settle
Processing map
CategoryTypePurposeShared withTransferKept forBasis
Pupil recordsPersonalTeaching and reportingParents, examination bodyStays in GhanaUntil age 25Statutory duty
Pupil health notesSpecial categoryCare and safeguardingSchool nurseStays in GhanaNot setConsent
Fee paymentsPersonalBillingPayment providerUnited States7 yearsContract
Newsletter listPersonalUpdates to parentsEmail platformEU or UKUntil unsubscribedNot decided

Open governance questions

  • Gap: How long is “Pupil health notes” kept?Set a retention period and a deletion routine.
  • Check: “Pupil health notes” is special-category data.Stricter conditions apply; confirm yours and limit access.
  • Check: “Fee payments” leaves Ghana (United States).Confirm the safeguards for cross-border transfer.
  • Gap: No processor contract for “Fee payments” with Payment provider.
  • Gap: What is the lawful basis for “Newsletter list”?
  • Check: “Newsletter list” leaves Ghana (EU or UK).Confirm the safeguards for cross-border transfer.

A preparation map, not a registration certificate or legal opinion. Confirm requirements with the Data Protection Commission and a qualified adviser.

Your full reportData-flow and retention mapTry this form

Practice 04: AI governance & assuranceFree · instant results on this pageTool owner: Michael Gagakuma and Kenneth GagakumaVersion 1.0 ·

GKM Strategic Advisory & AI

Data-flow and retention map

Your organisation

4 data categories · 3 questions to settle

PDF and XLSX · 24 September 2026

Your map as it stands, with the open governance questions. A working map for your own review.

Your full report

Data-flow and retention map, by email once delivery is connected.

Data-flow and retention map (PDF + spreadsheet) with the open governance questions

Preview only. No email will be sent. Your results are available above.

Nothing you enter here is sent anywhere. Privacy notice

· a free brief, or book Michael · from USD 90

How a line is read, and what it cannot tell you.

  1. 01

    Each personal-data category is checked for a purpose, a lawful basis, a retention period and, where data goes to a processor, a contract.

  2. 02

    Special-category data and transfers outside Ghana are flagged for additional safeguards.

  3. 03

    Lawful bases follow the grounds in Ghana’s Data Protection Act, 2012 (Act 843).

  • An open ring at the start: no lawful basis decided
  • A doubled line: special-category data
  • A gate on the border: personal data leaves Ghana
  • A break before the recipient: no processor contract
  • No end: no retention period set
  • A cap: kept for the period you wrote
  • A grey line: not personal data
Close on the stone floor: one inlaid line of brushed steel ends cleanly at a flush steel disc. Beside it a second line, of aqua glass, has no disc: it thins to a hair and runs out into the stone.
A retention period is an end. The cap repeats your own words; the map does not judge whether the period is long enough.

What it cannot tell you

  • Describe categories only; never enter real personal records.
  • It prepares questions; it does not decide your lawful basis or register you.
  • GDPR and other laws may apply as well when you serve people abroad.

Quality ruleNo sensitive records collected; no registration certificate promise.

When the open questions need settling.

The map lists what is open. Confirm requirements with the Data Protection Commission and a qualified adviser. Settling it with you is a service.

Service · 04 AI governance & assuranceGhana Data Protection Act registration & renewalService · 04 AI governance & assuranceResponsible-AI & data-protection review (Ghana DPA, GDPR-aware)
Tell us what you need A brief is free to send.
The terrace side of the same glass wall: the inlaid lines that crossed run on over the stone towards the sea at sunset.
Outside: the lines that crossed the threshold run on across the terrace.
Ghana Data Protection Act registration & renewalService · 04 AI governance & assuranceResponsible-AI & data-protection review (Ghana DPA, GDPR-aware)Service · 04 AI governance & assurance 04 AI governance & assurancePractice AI inventory & oversight registerFree toolAI policy templateFree toolAI content-disclosure checklistFree toolAI-readiness assessmentFree tool