GDPR Data Mapping

A couple of years ago, the EU countries replaced the long-existing data protection laws with a more modernised version, referred to as the General Data Protection Regulation, or GDPR. The governments of Europe do consider protecting individuals’ data of fundamental importance, as stated in the EU charter of Fundamental Rights. So, needless to say, this is what the GDPR law is based on. Basically, these laws seek to ensure that personal data is protected and do so through a human rights-centric approach, and also allow secure processing and transfer of the data across jurisdictions. Compliance with these regulations is a must for all organisations handling data for EU citizens. So, many of these organisations need to have a super solid grip on all the personal data in their possession and be able to map it back to specific individuals. And with data protection and processing growing and changing rapidly, organisations can no longer rely on traditional methods to achieve this. Organisations will definitely need a more effective system or tool to help them map personal data back to their customers. This is where data mapping comes into play! But what exactly is data mapping, and why is it so linked to the new GDPR law? This is what we will look at in this guide, so please stick around to find out more!

What is data mapping?

To put it simply, data mapping is the process of discovering and classifying personal data, enabling organisations to manage and protect the data more systematically. The data maps provide an easy-to-read data structure, detailing where the data comes from, who will use it, how it will be stored, and finally, where it will be sent. Also, through data mapping, organisations can identify lawful bases for processing personal data and apply retention periods to specific data sets. Essentially, generating these data maps helps organisations comply with all the EU’s applicable data privacy laws, particularly GDPR regulations.

How is data mapping linked to the GDPR?

Data mapping is a crucial component of the GDPR law. For starters, it is seen as a foundational step in fulfilling all the legal requirements, including responding to requests from data subjects and conducting data protection impact assessments, among others, as we will see shortly. Now, data mapping is directly mandated by several articles of the GDPR law, which means that organisations are required to carry it out regularly if they are to remain in compliance with the law. So, here are some examples of data mining requirements under the GDPR law;

Keeping records of processing activities (article 30) – this is one of the most crucial GDPR data mapping requirements regulations. The regulation states that;

• Data controllers shall maintain a record of processing activities under which they are responsible
• Data processors shall maintain records of all processing activity categories carried out on behalf of the controller
• It also states that all these records shall be in writing
• The organisation (processor or controller) shall avail all these records to the supervisory authority upon request.

These obligations apply only to organisations with over 250 employees. For organisations with fewer employees, the above obligations only apply if;

• The processing is not occasional
• The processing includes special data categories
• The processing is likely to put the rights and freedoms of the data subjects at great risk

Data protection impact assessment (Article 35) – in cases where data processing is likely to put data subjects at high risk, the GDPR law requires the organisation to perform data protection impact assessments (DPIAs). These assessments must consider the nature, scope, purpose, and context of the processing. Also, in conducting these assessments, the organisations must document the types of data they are collecting, how the data will be collected and used, how it will be stored, and how it will be transferred through various vendors and systems. Now, all this can only be done through data mapping.

Breach management – according to article 33 of the GDPR law, organisations must notify supervisory authorities of any data breaches likely to put the rights and freedoms of data subjects at great risk no later than 72 hours after becoming aware of it. And in instances where the risks to data subjects’ rights are much greater, the organisations are also required by the law to notify the subjects affected without undue delay. This is where data mapping comes in! Essentially, organisations use data maps to identify all the impacted data subjects and the compromised data in the event of a data breach. Also, data mapping enables the same organisations to assess the risks of the breach to data subjects, thereby enabling them to understand the severity, or lack thereof, of the breaches. This helps to know the breaches to report and the ones not to, based solely on the risks involved.

Consent management – the GDPR requires organisations to seek the consent of the data subjects before processing data. Article 4 of the regulations states that this consent must be freely given, informed, specific, and unambiguous, clearly indicating the individual’s wishes. Also, should the data subjects wish to withdraw their consent, they should be able to do it anytime and to no detriment. This may seem like a lot and could only prolong the process, and it could be true! However, data mapping helps organisations to identify those processing activities that require consent as a legal basis, saving time in the process. Also, it helps them to identify places where a consent capture mechanism could be necessary, and lastly, it also helps in consent revocation.

Fulfilment of subjects – the new GDPR law gave the data subjects more power over their personal data. It introduced a couple of rights and freedoms, including;

• The right and freedom to restrict the processing of personal data
• The right and freedom to access their personal data
• The right and freedom to rectify or erase their personal data
• And the right and freedom to port personal data.

Now, in exercising their rights, the data subjects do make specific requests, and the law requires the data controllers to respond to them within stipulated time frames. With that said, data mapping helps the controllers identify where the requested data is stored and facilitates individual requests effectively.

Key elements of data mapping

Here are the key elements of data mapping;

• Data items – this represents the kind of data that’s being processed, plus the category in which it falls.
• Format – this is the format in which the data is stored. Is it in digital form or hard copy?
• Location – this one focuses on the locations involved in the data flow, whether it is the cloud, other offices, or third parties
• Transfer method – this represents the way in which data is collected, plus how it is transferred, either internally or externally
• Accountability – accountability is a crucial aspect in GDPR compliance. So, there has to be someone who is accountable for the personal data at any point in time
• Access – it focuses on the individual allowed to access the personal data
• Lawful basis – before data processing, it is very important for organisations to identify a lawful basis for doing so.

Using a data mapping tool

In data mapping, there are specific tools you use for an efficient process. And while using such tools may seem unrealistic for smaller organisations, it makes much more sense for larger organisations, given that they deal with a lot of personal information, with smaller details that a human may miss but would be picked up by the tool. Anyway, with this software, all you need to do is grant all the appropriate functions, then leave the rest to the software. However, you need to choose your preferred tool wisely, as the effectiveness of the whole process solely depends on it. In fact, here are some benefits you can expect if you work with the right data mapping tool;

• Better transparency – as we’ve already mentioned, the main purpose of data mapping is to ensure that organisations are able to clarify how they are collecting, storing, using, and transferring personal data. So, an excellent data mapping tool should definitely help make the entire process as transparent as possible. It should enable the analysts to go through the entire process, confirming every detail that’s being reported. This way, you will be able to spot glitches, errors, and other potential risks, that you may otherwise miss.
• Streamlined data analysis – in data mapping, there is a lot of data that you need to track, and it’s from different sources. The data may appear in different formats and must be reconciled into a single map. With that said, the right mapping tool ought to handle the transformation of such data and also streamline the analysis process, which ensures that all the data has been accurately compiled into a single source.
• Ease of updates – being a requirement under the GDPR law, data mapping needs to be performed regularly. And so, a good tool will make it easy for the organisation to carry out these regular updates and will also track the changes made across every update. What’s more, the tool should keep the older versions of data maps, and also give you the option to revert to a previous file when necessary.

With that said, when selecting a data mapping tool, make sure that you consider elements like; ease of use, flexibility, and automation.

What are some of the best practices in data mapping?

In any data mapping process, losing track of the bigger picture is actually quite common. And so, to ensure that you stay on top of the entire process, here are a couple of best practices that you should follow;

Choose your tools – before you start collecting data, you have to figure out how you are going to do the mapping. By setting up your tools in advance, you will be able to map out your data processes efficiently and effectively. Your choice of tools depends on the amount of data you are dealing with and the kind of data you collect.

Identify your data types and sources clearly – given that the very essence of data mapping is to be able to identify every aspect of data processing, it is important that you identify the type of data you are collecting clearly, plus where exactly the data comes from. Remember, the more specific you are, the more accurate the data map will be.

Secure the mapping process – in data mapping, it’s important to remember that you are still interacting with personal data – the data you are trying to protect. So, no matter what, you have to maintain the mapping process as securely as possible. As data maps detail how you protect data, you need to ensure that you limit access to these maps only to authorised persons.

Periodic updates – as the business changes, the data being gathered also changes. For this reason, having regular updates is always crucial and is considered a best practice. The more regular the updates, the less likely mistakes will occur, which, in turn, means better GDPR compliance.

Retain records – other than the data maps, you need to retain extra records detailing the transfer of data to other vendors. With such records, you will be able to demonstrate that the initial maps are super accurate, and during a GDPR audit, you will be able to provide more resources to prove compliance.

Top benefits of data mapping

While it is largely seen as a visualisation tool, it also offers several other benefits, including the following;

Enhancing GDPR compliance – considering that GDPR law is all about data privacy, and with non-compliance heavily penalized, total compliance is of utmost importance. With that in mind, data mapping makes it super-easy for you to remain compliant by monitoring how transparent and fair you are when processing data. Remember, transparency and fairness are major aspects of GDPR compliance.

Spotting and fixing privacy risks – it is through data mapping that you clearly understand how well you are protecting your clients’ personal data. Also, mapping helps identify and rectify risks as you go through every aspect of your data processing processes.

Helps in producing processing reports – when you look at the GDPR law, you will see that one of the most crucial clauses is in Article 30, which states that organisations are required to file Report of Processing Activity (ROPA) reports, detailing how they are collecting and using personal data. So, with a data map, you will have gathered all the information needed for these reports, meaning that you will be able to easily submit them upon request.

Responding to privacy requests – the GDPR law gave the data subjects exclusive rights regarding their personal data. So, they can request you to delete their data anytime, and the law requires you to oblige unless there is a reasonable cause not to. Now, in doing so, you first need to understand where the data is stored. This is where a data map comes in handy, as it helps you easily find all the individual data from wherever it is. And when it comes to deleting or updating the data upon request, it also becomes relatively easy.    

Final thought

Complying with the massive GDPR might seem like an unachievable goal, but the truth is, all you need as a business is to try and address the law bit by bit. Over time, your business will be able to adjust to the privacy standards and customer demands accordingly. Data mapping will certainly help you in this aspect. Other than helping towards total GDPR compliance, data mapping is also very good for your business, as we have seen throughout this article. In addition, by understanding the link between GDPR compliance and Data Mapping and also taking full advantage of the mapping tools, ultimately, you will be able to take data protection to the next level.