Introduction
Data privacy and security are of utmost concern in the digital era of today, especially when it comes to data protection regulations like the GDPR, CPPA/CPRA, POPIA, nFADP with precise requirements for collecting, using, storing, and transferring personal data.
To that end, performing a comprehensive personal data mapping is an essential part of the process. It helps you identify all the personal data you collect, process, and store. This is an essential step towards privacy compliance, as it allows you to understand your personal data processing activities and assess your data privacy risks.
In this post, we’ll dive into the concept of personal data mapping – its importance according to the GDPR and other regulations, provide instructions how to perform the data mapping and what common challenges to avoid.
What is Personal Data Mapping?
Personal data mapping is a systematic approach to understanding and documenting how personal data is stored, collected, used, and shared within an organisation and with third parties. The process involves the creation of Records of Processing Activities (RoPA), Asset Registers and Data Flow Maps.
While Records of Processing Activities are obligatory to ensure compliance with data privacy regulations such as the EU and UK GDPR, Swiss nFADP and South African POPIA, the Asset Register and Data Flow Map are optional but strongly recommended components to take maximum advantage of the knowledge, avoid compliance gaps and strengthen organisation’s compliance with the regulations.
Components of Personal Data Mapping
Inventory of Personal Data or Asset Register
The term Asset Register comes from ISO27001 – the leading information security, cybersecurity and privacy protection standard. ISO 27001 creates a structured approach for businesses of all sizes to effectively secure their data by adopting an information security framework. While not all organisations are required to adopt the ISO27001 standard, the Asset Register helps in having a clear understanding of where the data is located, what systems are related to the processing of data, and what security measures are in place at each storage location.
You can find more information about Asset Register in our article Asset Register for ISO27001 and GDPR compliance.
Records of Processing Activities (ROPAs)
Article 30 of the GDPR requires organisations to keep detailed records of personal data processing activities. Such records have to be kept in electronic form and must include information such as categories of personal data processed, categories of data subjects whose data is processed, the purpose of processing, data retention periods and recipient details.
According to Article 83(4)(a) of the GDPR, companies may be subject to fines if they fail to keep a record of their processing activities and/or do not offer comprehensive accountability documentation to authorities. These possible fines have the maximum potential of 2% of total annual turnover or 10 million euros.
You can find more in-depth information about RoPAs in our article on Records of processing activities in GDPR Article 30.
Connectivity
While each register separately provides quite a good overview of personal data inventory and processing operations happening with them, maintaining them separately may become an overwhelming burden over time. This will lead to outdated and inconsistent information.
This is why we would like to stress cross-referencing all records between each other. It will ensure that changes in one registry will reflect in another and appropriate actions may be triggered against them.
Moreover, all the rest of privacy compliance documentation like privacy policy or data retention records should be connected to the registers to allow proper tracking of changes.
As part of your record of processing activities, it can be useful to document (or link to documentation of) other aspects of your compliance with the UK GDPR and the UK’s Data Protection Act 2018." Read more at ICO website.
What are the benefits of well-designed data mapping?
Compliance with Regulations and Improvement of Data Governance
Compliance with regulations such as GDPR (Art. 30), Swiss nFDPA (Art. 12), POPIA (Section 17) and CPPA/CPRA, requires organizations to have a clear understanding of the personal data they collect, process, store and share. Data mapping helps organizations to achieve this objective by identifying the types of personal data they hold, the purposes for which it is used, the legal basis for processing, and the categories of third parties with whom it is shared. Data mapping is critical for effective data governance, including data quality, data security, and data privacy.
Important source of information for the rest of documentation
Creating privacy-related documentation, such as privacy policies or data protection impact assessments (DPIAs), becomes easier once a correct personal data mapping has been created. This is because the personal data mapping provides a comprehensive overview of the personal data that an organization collects, processes, stores, and shares.
For example, a privacy policy can be developed that clearly explains to individuals what personal data is collected, why it is collected, how it is processed, and with whom it is shared. Similarly, a DPIA can be developed that identifies potential risks associated with processing personal data and provides recommendations for mitigating those risks.
Furthermore, having a correct personal data mapping ensures that privacy-related documents are accurate and up-to-date. As an organization’s data processing activities change, the data mapping can be updated, and the privacy-related documents can be revised accordingly. This helps to ensure that the organization remains in compliance with privacy regulations and that individuals’ rights are protected.
Enhanced Risk Management
Data mapping helps organizations to identify potential risks associated with the processing of personal data. This includes risks related to data breaches, data misuse, and data subject rights violations. By identifying these risks, organizations can implement appropriate controls to mitigate them.
Facilitates Data Subject Rights
Data mapping helps organizations to identify the personal data they hold on data subjects, where it is stored, and who has access to it. This information is critical for responding to data subject requests such as access, deletion, and rectification.
How to Perform a Comprehensive Data Mapping Project?
By following these steps, organizations can ensure they are complying with privacy regulations such as GDPR and protecting individuals’ personal data.
1. Identify Data Sources
Identify all the places where you collect personal data, such as websites, mobile apps, customer relationship management (CRM) systems, and marketing automation tools. Don’t forget to include cookies, pixels, and other tracking technologies that may collect personal data.
2. Create Inventory of Personal Data Categories
List all the personal data you collect, including but not limited to names, email addresses, phone numbers, and IP addresses. Remember that the GDPR defines personal data broadly, so you need to identify any data that relates to an identifiable natural person.
3. Define Data Flows
Map out how personal data flows within your organisation and with third-party processors, including cloud providers, payment processors, and marketing agencies. This will help you identify any potential risks or vulnerabilities in your data processing activities.
4. Cross-Border Data Transfers
Determine whether you transfer personal data outside of the European Union (EU) and if so, identify the countries where the data is transferred to. The GDPR has specific requirements for cross-border data transfers, so you need to ensure that your data is protected wherever it goes and that the transference process is also GDPR-compliant.
5. Identify the Purposes of Processing
Document the purposes for which you process personal data, such as providing a service, sending marketing communications, or conducting research. Ensure that your purposes are lawful, specific, and compatible with the actual intent of collection.
6. Data Retention Rules
Establish clear policies for how long you retain personal data, and ensure that you delete it when it’s no longer necessary for the purposes of the processing. This will help you comply with the GDPR’s storage limitation and data minimisation principles.
Typical Challenges of Data Mapping Projects
Organizations may face several challenges when mapping personal data, but there are ways to overcome these challenges. Here are some possible solutions:
Problem
Solution
Lack of Visibility
The first challenge that organizations may face is a lack of visibility into their data processing activities. This can happen if an organization has a large and complex IT infrastructure, with data stored in multiple locations and by various departments. In such cases, it can be challenging to identify all the data sources and the data flows between them.
To overcome this challenge, organizations can start by conducting a data inventory to identify all the data sources they collect and process. You should create a systems and information asset register that will describe all the data collection, storage, access and activation locations. Read more about how to create an Asset Register here.
Complexity of Data
Personal data can be complex and multi-faceted, which can make mapping it a challenging task. For example, personal data can include sensitive information such as health records, financial information, and biometric data. Mapping this data requires a detailed understanding of the types of data collected, how it is processed, and with whom it is shared.
To address this challenge, organizations should identify the different types of personal data they collect and process, such as sensitive data, and determine the appropriate security measures needed to protect this data. Organizations can also work with third-party experts to help them understand the complexities of their data and provide guidance on mapping it.
Resource Constraints
Creating a comprehensive inventory of assets and records requires significant time, effort, and resources. Many organizations may not have the necessary resources or knowledge to devote to this task. Different stakeholders in the organization have their everyday priorities and often it’s not easy to get enough attention to the data mapping project and it keeps to last forever. Moreover, privacy team resources may be blocked during the project time and they can’t perform their everyday task for multiple months.
You can use GDPR Register’s project management service to ensure the success of the mapping project. Within this service, we will help you to organize the privacy project team, explain to the personnel the importance of the project and its methodology, assign tasks, support them during all phases of the project and ensure timely results.
As a result, you will get a team of stakeholders who understand how personal data is processed within the organization, they can perform maintenance of the records and keep documentation up to date, while your privacy management resources will still be available during the whole project.
Changing Landscape
The processes within organizations and data privacy regulations are constantly evolving, and organizations must keep up with these changes to remain compliant. Privacy regulations require organizations to maintain their data processing activities in detail and keep them up-to-date, but often happens that there is no regular updating process defined after the mapping is done, and areday in year or two whole documentation has to recreated from scratch
To avoid such a situation, organizations should regularly review their data mapping processes and update them accordingly. This can be done by appointing data and process owners who will be responsible for ensuring that records and information assets are always up to date. Read more about how to ensure proper responsibility management with GDPR Register Data Mapping tools here.
Conclusion
In summary, by taking a systematic approach to mapping personal data and addressing the challenges of visibility, complexity, changing regulations, and resource constraints, organizations can create a comprehensive data processing inventory that will help them stay compliant with privacy regulations and protect individuals’ personal data.
With the privacy regulations requiring strict standards on data protection, it is crucial to understand how and where personal data is collected, processed, and stored. That’s where the personal data mapping comes in. By creating a comprehensive data mapping process, you can ensure compliance, identify potential risks and mitigate them.
