Privacy team spends 3 months every year manually mapping data flows by sending questionnaires to engineering teams and chasing responses — by the time the data inventory is complete, engineering has shipped 20 new features and the map is already stale, leaving the DPO unable to answer a regulator's question about where personal data actually lives