What is data mapping & why do businesses need it

What is data mapping?

Data mapping is a method of documenting the information flow inside and outside of an organisation, including the types of data collected, their purposes, and the locations of storage and processing facilities. 

Data mapping can be done in a number of ways, from using a basic spreadsheet to investing in a specialised application, and the depth or breadth of your data mapping will be determined by your specific industry. If you need to comply with foreign data privacy rules, a data map offers an easy-to-read framework that includes all the information you need.

Effective data maps need input from divisions like IT, legal, marketing, and human resources in particular. Additionally, your Data Protection Officer (DPO) or another senior member of your privacy team should keep a careful eye on the documentation of all data.

How does data mapping relate to GDPR?

Data mapping is a continuous process that should be incorporated into your regular business procedures, but it is something that should be done as soon as possible — especially if you are required to comply with the UK GDPR.

The UK GDPR introduces laws to enhance the data security rights of individuals by requiring transparency from organisations. Businesses need to be clear about what they do with personal data, and having an accurate map of this data flow helps to comply with these regulations.

Apart from a limited exception of small or medium size organisations, the UK GDPR mandates that organisations must keep a record of all personal data. Data mapping allows you to do this in a systematic way so that you can identify and visualise the complete flow of organisational data.

Data mapping can be the starting point of your GDPR compliance journey, but compliance isn’t the only benefit that data mapping offers.

How can data mapping be helpful for your organisation?

The use of data maps goes beyond that of a simple visualisation aid. It offers a variety of advantages that might aid in meeting the requirements of the GDPR and protecting the privacy of your clients. These are just a few of the many advantages of data mapping:

• Spotting privacy risks and fixing them - Data maps provide clarity regarding the extent to which you are preserving the privacy of your organisation's customers. To draw a complete data map, it is important to look at every step in the processing chain, highlighting any potential privacy issues. As soon as you know about the problems, you may start working to remedy them before they cause any real damage.

• Identifying security opportunities - After you have dealt with any threats, your data map will show you where you can strengthen the security of your data processes. Instead of only responding to threats and hazards, you might instead focus on the most promising security opportunities.

• Responding to privacy requests - Customers have the right to have all of their personal information deleted per the GDPR. To do this, you must be familiar with the information you have collected and its storage locations. A data map provides a streamlined method of locating an individual's data across all platforms and contexts. In this way, you may safely remove the data without worrying about losing any essential records.
• Remaining compliant with the GDPR - The GDPR is a major data privacy law in the field of data privacy protection. Maintaining compliance with the GDPR is simplified with a good data map, since you can see at a glance whether or not you are meeting the law's standards for transparency and fairness.

What are some methods of GDPR data mapping?

Data mapping is considered to be the starting point of meeting any of the UK GDPR’s other legal requirements. Some examples of data mapping include:

• Data protection impact assessments - Data protection impact assessments (DPIAs) are conducted by organisations where processing poses a high risk to people. The scope, context, and goals of the processing should all be factored into a DPIA. Data mapping helps organisations describe what sorts of data they gather, when and how that data is acquired and used, where it is kept, and how data flows through multiple systems and suppliers. 

• Processing activity records - Controllers and processors are required by Article 30 of the UK GDPR to keep a record of processing activities (ROPAs). Process-related data such as the processing's intent, legal justification, consent status, international data transfers, and DPIA status are all included in ROPAs. Data mapping helps by collecting a list of such data processing activities.

• Breach management - In the event of a breach, data mapping helps organisations identify affected data subjects and compromised data. It allows them to assess the dangers to data subjects' rights and freedoms from a security breach, helping them disclose only personal data breaches that meet a specified risk threshold. They can therefore adhere to the 72 hour breach notification deadline.

• Consent management - To utilise user permission as a valid basis for data processing, you must ensure that it is freely provided, precise, informed, and a clear expression of the data subject's wishes. Additionally, data subjects must be allowed to revoke their permission at any moment without penalty. Consent-based processing activities can be identified and highlighted, and consent collecting methods can be implemented with data mapping.

Although there are various methods of data mapping, all of them fall under one of two categories.

What are the types of data mapping?

There are two options for organisations to improve their understanding of personal data through data mapping — manual data mapping and automated data mapping.

• Manual data mapping - Generally, this is implemented through informational questionnaires or interviews. The data is first collected in person or through paper surveys before it is collected and analysed.

• Automated data mapping - In this method, data mapping is technologically assisted. It can be done through electronic surveys or scanners that detect data collection and its movement around the organisation's electronic systems.

Whichever method you choose, if the data mapping is done correctly, both methods will provide the same results.

What are the key elements of data mapping?

A detailed data map displays all the data coming into an organisation and its path around and out of the organisation. It should include the following key elements:

• What data is collected

To protect their customers' privacy, organisations must have a thorough understanding of all the personally identifiable information (PII) stored in their systems. It might be information on clients, site visitors, or even workers. Under the GDPR, "personal data" refers to any information about an identified or identifiable natural person. Name, number, location data, online identifier, or one or more physical, physiological, genetic, mental, economic, cultural, or social identifiers of a natural person are all examples listed in Article 4.

• Where data is collected

The source of any incoming personal data must be identified by organisations. This usually comes from the customer (end user) themselves via some sort of online survey. However, many organisations are relying on third-party data providers to get supplementary details about their customers. Organisations must be aware of the data they are collecting and from what sources, as well as their responsibilities under the GDPR.

• Where the data is stored and the format of data

An organisation cannot have a good grasp of its data privacy procedures without knowing where that data is stored and in what format it is kept. While most organisations now only save data digitally, some may still keep paper copies of older documents or have staff print off files containing personally identifiable information for their own use. With data stored everywhere from the cloud to local servers and individual PCs to the hardware of third-party providers, even digital files require a thorough audit.

• Where the data goes

There should be transparency regarding the destination of company data, whether it is being shared inside or sold to a third party. Due to the unique implications of transferring personal data outside the European Union, it is crucial to keep track of whether or not data is transferred across borders upon its initial delivery to the organisation, during a transfer to or from a processor, or during a transfer for internal purposes.

• What the data is used for

Organisations need to be aware of their processing operations in order to meet Article 30 documentation obligations and to offer proper disclosures to consumers. Privacy by design and data minimisation are two more practices that must be demonstrated by organisations. The use of data maps can aid in the collection of this data.

• How long the data is retained

Along with data minimisation and privacy by design, data retention is also crucial. Most data flow mapping efforts are put toward tracing the information's creation and distribution, but a more complete picture may also take into account the information's deletion by the organisation.

Adding these key elements into your data map comes with a few challenges that can be overcome with a thorough understanding of the subject.

How do you conduct data mapping? 

There are many methods of data mapping, so knowing where and how to start may seem confusing. However, this process can be broken into six stages that can give you a clearer idea of what to do:

Stage 1: Locate data processing centres

Create a basic map by identifying the areas of your organisation where data is processed and used. Your staff may need to answer questions like what their tasks are and what KPIs they use, after which you can select the answers that are most relevant to your data map. These questions will provide an overview of the types of information that flow within the organisation. 

Stage 2: Gather specific details

Collect more information about the data processing activities in your organisation. Find out how the data is collected, its purpose and how it is stored and transferred. Create a spreadsheet for this so that it is easier to cross-reference later.

Stage 3: Connect data processing activities to respective parties

As soon as you have collected this data, you may begin creating your map. A data map may be made quickly by importing a spreadsheet with the collected information into a data map generator.  

Each responsible party can be represented on the map as a node, with information flows linking them. Each node can serve as a home base for a distinct set of operations including the collection, processing, and storage of data. The end product should be an easy-to-understand graphic depiction of your company's information-handling processes.

Stage 4: Identify gaps

Non-compliant data processes, missing transfers and missing parties are all examples of gaps that you may find. You need to address these to make your map accurate and comply with the UK GPR. You can also make improvements while fixing these gaps.

Stage 5: Generate reports

Reports like the Article 30 ROPA and other legal reports require the use of a data map. You can also use this map to create data flow diagrams and cross border maps.

Stage 6: Maintain your data map

A data mapping best practice is to keep your maps updated and check them quarterly to keep them from becoming out of date. Maintenance ensures that you always have an understanding of your organisation’s data processing activities, and the means to provide documentation if necessary.

What are the key challenges of data mapping?

To ensure UK GDPR compliance, your organisation’s DPO should play a crucial role in creating a data flow map. Among the challenges you may face are the following:

• Identifying personal data - Information about an individual can be kept in a variety of places and media, including paper, electronic, and audio. The first obstacle is determining the specifics of what data has to be recorded and how.

• Identifying technical and organisational safety measures - You must secure data and identify those with permission to view it. To achieve this goal, you must determine both the suitable technology and the associated policy and process.

• Understanding legal and regulatory obligations - There may be additional legal and regulatory requirements beyond those of the UK GDPR. Additional compliance standards, like the Payment Card Industry Data Security Standard (PCI DSS) ISO 27001, may be applicable here.

Once you have overcome the challenges of data mapping, you can continue to incorporate some data mapping best practices that can improve your success.

What are some best practices for data mapping?

It is easy to lose sight of the bigger picture while handling the mapping process. These best practices for data mapping will help you remain on top of the process and reduce the amount of work you have to put into making adjustments.

• Choose the correct tools - It is important to plan out how you will organise your data before you start gathering it. Data processes may be planned more effectively when necessary tools and resources are prepared in advance. Which option you choose depends on how much data your company processes and what kinds of data you collect.

• Keep the mapping process secure - You will typically engage directly with private data when doing data mapping. The mapping procedure must be as secure as other data processing activities. Since your data map explains how you protect consumer data, malicious people may be able to overturn your security. Your data mapping tools should be as safe as the most sensitive data you save. Only authorised persons should be allowed to view or update the map to prevent prying eyes.

• Perform periodic updates - Over time, both your organisation and the data it collects will evolve. As a result, it is recommended that you update your data map at least once every three months, if not more frequently. More frequent updates reduce the risk of unnoticed privacy issues or non-compliance issues leading to legal trouble.

• Clearly identify your data sources and types - The goal of data mapping is to clearly define each step in your data processing activities. That requires specifying the sources and nature of the data available. Did you get this information from the consumer themselves, or some other source? Do customers know their information has been collected? You can make a better data map if you answer questions like these.

What are data mapping tools and how can they help?

Data mapping software is the easiest way to create your data map, especially if your organisation is large. You will only need to secure the program, give it any appropriate permissions and select how you want your map to be created.

Since data mapping should be a regular activity, choosing a good tool is important. Consider the flexibility and automation of the tool, but more importantly how easy it is to use. When working with the right tool, you can experience better transparency and a streamlined data analysis, plus faster data tracking to ease the updating process.

How can I get started with data mapping?

If your organisation is involved in processing data on a large scale or monitoring individuals on a large scale, you will need to appoint a DPO, according to the UK GDPR. If you already have a DPO, they can help you get started with the mapping process, but only if they are experienced in it.

Talking about your data flows with representatives from all departments in your organisation is a good place to start. Once you understand how your staff uses data, you can then start mapping out the data flows. Remember to also make this compliance process collaborative so that everyone in your organisation understands what they can do to proactively contribute to data mapping and GDPR compliance.

If you need further help getting started, our GDPR consultants are always available.

Conclusion

Over the recent years, the GDPR has become a prominent and daunting legislation that, at first, may seem difficult to achieve. But, approaching it step by step is considerably easier. Mapping your data is an important first step in this direction. It is not just a necessary action for GDPR compliance, but also an effective method of running a firm. Ultimately, you can better secure your users' data — and your business — by leveraging the mentioned tools and resources and gaining an understanding of the connection between data mapping and GDPR compliance.

Need support with GDPR Compliance? Wait no more. Arrange a free initial consultation with one of our experts today.