What is Data Mapping ?
Data mapping is the process of visualizing and documenting the path of data through a system or organization.
This includes :
- Identification of sources
- Tracking the movement of data through processes
- Documentation of data schemas
- Authorization management and GDPR compliance
The goal is to get a clear view to ensure data quality and security. But also, to ensure compliance and facilitate the management of data assets.
Develop a map of your personal data processing operations
As part of implementing the GDPR compliance action plan, organizations must develop comprehensive internal documentation.
This action plan concerns the processes for processing personal data. It is imperative to ensure compliance with new legal obligations.
In order to assess the impact of the regulation on your activity and to meet this requirement, you must first carry out an accurate inventory of :
- The various processing of personal data;
- The categories of personal data processed;
- The purposes pursued by the data processing operations;
- Stakeholders (internal or external) involved in these treatments. It is crucial to clearly identify the subcontracted providers to update the confidentiality clauses;
- Data flows, specifying the origin and destination of the data. In particular, to identify possible data transfers outside the European Union.
Steps to follow
Within your GDPR data map, for each processing of personal data, please ask yourself the following questions:
WHO ?
- Register the name and contact details of the controller (and their legal representative) in the register. As well as, where applicable, the Data Protection Officer.
- Identify who is responsible for the operational departments that process data within your organization. Make a list of subcontractors.
WHAT ?
- Identify the categories of data being processed.
- Identify data that may pose risks due to its particular sensitivity. For example, data relating to health or offences.
WHAT FOR ?
- Indicate the purpose(s) for which you collect or process this data (e.g. commercial relationship management, HR management, etc.).
WHERE ?
- Determine where the data is hosted.
- Specify which countries the data may be transferred.
UNTIL WHEN ?
- For each category of data, specify how long you will keep it.
HOW ?
- What security measures are implemented to minimize the risk of unauthorized access to data. And, therefore, the impact on the privacy of data subjects?
Dastra GDPR Mapping Software
Do you want to easily set up and manage your data mapping ? Try Dastra GDPR Compliance Software!
