This website uses cookies. View our cookie policy
United Kingdom
Select regional store:

Data mapping under the EU GDPR

As part of an EU General Data Protection Regulation (GDPR) compliance project, organisations will need to map their data and information flows in order to assess their privacy risks and to form part of their Article 30 documentation. It is also an essential first step for completing a  data protection impact assessment (DPIA), which is mandatory for certain types of processing. You can find out more on data flow mapping under the GDPR in our free green paper.

For advice and guidance on data flow mapping, and to find out more about the support options we can offer you, get in touch with one our GDPR experts today. 

Speak to an expert

The key elements of data mapping

To effectively map your data, you need to understand the information flow, describe it and identify its key elements.

1. Understand the information flow

An information flow is a transfer of information from one location to another, for example:

  • From inside to outside the European Union; or
  • From suppliers and sub-suppliers through to customers.

2. Describe the information flow

  • Walk through the information lifecycle to identify unforeseen or unintended uses of data. This also helps to minimise what data is collected.
  • Make sure the people who will be using the information are consulted on the practical implications.
  • Consider the potential future uses of the information collected, even if it is not immediately necessary.

3. Identify its key elements

  • Data items

    What kind of data is being processed (name, email, address, etc.) and what category does it fall into (health data, criminal records, location data, etc.)?
  • Formats

    In what format do you store data (hardcopy, digital, database, bring your own device, mobile phones, etc.)?
  • Transfer method

    How do you collect data (post, telephone, social media) and how do you share it internally (within your organisation) and externally (with third parties)?
  • Location

    What locations are involved within the data flow (offices, the Cloud, third parties, etc.)?
  • Accountability

    Who is accountable for the personal data? Often this changes as the data moves throughout the organisation.
  • Access

    Who has access to the data in question?
  • Lawful basis

    Identify the lawful basis used for processing the personal data.

The key challenges of data mapping

1. Identifying personal data

Personal data can reside in a number of locations and be stored in a number of formats, such as paper, electronic and audio. Your first challenge is deciding what information you need to record and in what format.

2. Identifying appropriate technical and organisational safeguards

The second challenge is likely to be identifying the appropriate technology – and the policy and procedures for its use – to protect information while also determining who controls access to it.

3. Understanding legal and regulatory obligations

Your final challenge is determining what your organisation’s legal and regulatory obligations are. As well as the GDPR, this can include other compliance standards, such as the Payment Card Industry Data Security Standard (PCI DSS) and ISO 27001.

Once you’ve completed these three challenges, you’ll be in a position to move forward, gaining the trust and confidence of your key stakeholders.

For further information on data flow mapping under the GDPR, download our free green paper >>

Data flow mapping

The Data Flow Mapping Tool simplifies the process of creating data flow maps, giving you full visibility over the flow of person data through your organisation.

Conducting a data flow mapping exercise under the GDPR - Webinar

Watch our webinar below to find out more about conducting a data flow mapping under the GDPR.

View our free PDF to discover the benefits of the Data Flow Mapping Tool >>

Map your data and become GDPR compliant with IT Governance 

We have a selection of tools and software that can support your organisations GDPR compliance, no matter how far along you are in your project. Browse our range of GDPR products and services below.

Shop our data flow mapping products and services

Download our free resource

Speak to an expert

Please contact our GDPR team for advice and guidance on our products and services.