GDPR Data Mapping: What is it and how to comply 

Data mapping under the EU GDPR

To comply with the EU GDPR (General Data Protection Regulation), organisations need to map their data flows to assess privacy risks.

Conducting a data flow map forms part of your Article 30 documentation. They are also an essential first step in completing a DPIA (data protection impact assessment).

For comprehensive guidance and practical advice on complying with the GDPR, read our bestselling EU General Data Protection Regulation (GDPR) – An Implementation and Compliance Guide, Third edition.

Creating data flow maps

To effectively map your data, you need to understand the flows of data, describe it and identify its key elements.

1. Understand the information flow

Information flow is the transfer of information from one location to another, for example:

  • From inside to outside the European Union; or
  • From suppliers and sub-suppliers through to customers.

2. Describe the information flow

  • Walk through the information lifecycle to identify unforeseen or unintended uses of data. This also helps to minimise what data is collected.
  • Make sure the people who will be using the information are consulted on the practical implications.
  • Consider the potential future uses of the information collected, even if it is not immediately necessary.

3. Identify its key elements

  • Data items

    What kind of data is being processed and what category does it fall into?
  • Formats

    In what format do you store data (hard copy, digital, database, bring your own device, mobile phones, etc.)?
  • Transfer method

    How do you collect data and how do you share it, both internally and externally?
  • Location

    What locations are involved within the data flow (offices, the Cloud, third parties, etc.)?
  • Accountability

    Who is accountable for the personal data? Often this changes as the data moves throughout the organisation.
  • Access

    Who has access to the data in question?
  • Lawful basis

    Identify the lawful basis used for processing the personal data.

The key challenges of data mapping


Identifying personal data

Personal data can reside in multiple locations and can be stored in many formats, such as paper, electronic and audio. Your first challenge is deciding what information you need to record and in what format.

Identifying appropriate technical and organisational safeguards

You need to protect information and determine who controls access to it. To do this, you will need to identify the appropriate technology and the policy and procedures for its use

Understanding legal and regulatory obligations

Your legal and regularity obligations may extend beyond the GDPR. This can include other compliance standards, such as the PCI DSS (Payment Card Industry Data Security Standard) and ISO 27001.

For further information on data flow mapping under the GDPR, download our free green paper

Map your data and become GDPR compliant with IT Governance

We have a selection of tools and software that can support your organisations GDPR compliance, no matter how far along you are in your project.

To gain full visibility over the flow of personal data through your organisation and meet the requirement to maintain a record of processing activities under Article 30 of the GDPR, we recommend the Data Flow Mapping Tool.

This tool simplifies the data flow mapping exercise, giving you a thorough understanding of what personal data your organisation processes and why, where it is held and how it is transferred. The Data Flow Mapping Tool is a Cloud-based application, licensed for up to five users and can be accessed via any compatible browser.

This website uses cookies. View our cookie policy
20% OFFTRAINING