Getting all of this info will likely involve a corporation-huge audit and stakeholders in all aspects of the organization must be associated with this assessment. Generally, collection and processing things to do occur in departments that aren't Usually related to info processing. So, information mapping is a vital initial step https://sites.google.com/view/gdpr-compliance-in-usa/