Map data fields to GDPR categories and special-category flags

It recognizes common English signals for health, biometric identification, genetic information, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and sex life or sexual orientation. The result is deterministic and easy to audit, making it useful for an early inventory pass. Because names can be vague, every result includes a reminder that actual values and processing context still require human review.

Start a data inventory with consistent labels

Privacy reviews often begin with a spreadsheet containing hundreds of database columns, form controls, event properties, and export headers. Those names may use snake case, camel case, hyphens, abbreviations, or phrases chosen by different teams. This mapper normalizes those common separators and checks each name against a transparent set of English naming signals. A field such as medical_history is marked as health data, while customerEmail falls back to general personal data. The response preserves the original name, reports the assigned category, indicates whether the category is special, and identifies the heuristic that produced a special-category match. Counts summarize the list so a reviewer can quickly see where attention is needed. This is especially useful before a data protection impact assessment, a records-of-processing update, or a schema review, because it creates a repeatable first pass instead of relying on inconsistent manual labels. It does not inspect databases or transmit a request to another service; it classifies only the field names supplied in the request.

Understand conservative heuristic matching

The algorithm uses complete normalized words and phrases rather than loose substrings. That distinction reduces surprising matches: a short sequence of letters embedded inside an unrelated word does not automatically make the field special-category data. Rules cover recognizable terms associated with health and clinical records, biometric identifiers used for identification, genetic and genomic material, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and sex life or sexual orientation. When more than one signal appears, a stable rule order selects one category, so identical input always produces identical output. Names without a recognized special-category signal are labeled general_personal_data; this does not mean they are harmless, anonymous, or outside the GDPR. Email addresses, names, device identifiers, addresses, and account numbers can still be personal data and may demand strong controls. The fallback simply distinguishes them from the special categories detected by this naming review. Review the returned matched heuristic to understand why a classification occurred and to identify organization-specific vocabulary that the common rules cannot know.

Treat the result as triage, not legal advice

A column name cannot reveal everything about the information stored beneath it or the purpose for which it is processed. A field called notes might contain medical details, political views, or no personal information at all. Conversely, a field called face_photo is not necessarily biometric data merely because it contains an image; biometric special-category treatment depends on specific technical processing for unique identification. The mapper therefore supports inventory triage rather than a final legal conclusion. Use flagged entries to prioritize conversations with data owners, inspect representative values under appropriate access controls, document processing purposes, and confirm the lawful basis and safeguards with a qualified privacy professional. Also review unflagged fields, especially free-text columns and opaque internal codes. For automated governance, keep the original field list and mapper output together so reviewers can reproduce the classification and record overrides. The API charge is $0.002 per request, while the browser execution is suitable for an immediate check. No network lookup, randomness, or current-date dependency changes the result between runs.