Correctness and regulatory compliance (e.g., with the EU General Data Protection Regulation) are core issues for every organization. Business process modeling is an appropriate method to make potential problems visible and thus improve compliance of the processes. Compliance is controlled at different levels. First, corporate management should clearly understand the company’s relevant data processing. Second, supervisory authorities have the legal obligation to monitor compliance. In either case, this control is typically performed manually using paper reports. An automated control (during design time and in the production phase) based on business process models is desirable to increase effectiveness and usability. The paper presents an approach for marking sensitive aspects in business process models with colored labels representing personal data categories. These new concepts provide a fast and comprehensible graphical annotation of business process models. They allow humans to assess critical parts of processes and support optimizations for better data protection and privacy.