Data Mapping Process Steps & Workflow for GDPR Compliance

Most companies must manage massive amounts of data originating from countless sources. Enterprises often rely on several data storage systems, and each system may store that data in different ways and locations.

A truly Live Data Map should act as the strong foundation for your organization’s data privacy program and provide a much-needed framework for businesses seeking to analyze and act upon their data, migrate data between systems, or transition from legacy systems to newer modalities.

But what is a data map, and how does it serve within a privacy program framework?

This guide breaks down the purpose, processes, and tools you need to know.

What Is Data Mapping?

Data mapping is an essential, foundational process for organizations that desire a comprehensive and compliant privacy program. It involves identifying the type, location, and flow of personal data throughout an organization.

This information is crucial for:

Assessing risks associated with the processing of personal data
Identifying compliance obligations
Implementing appropriate privacy controls

The resulting output of Data Mapping is called a RoPA (Record of Processing Activities) which is required by law as part of the European Union’s General Data Protection Regulation’s (GDPR) Article 30.

The data mapping process involves tracking, documenting, and inventorying the various data elements (data sources, data fields, data systems, data warehouses, etc.) a company controls and uses to collect data, along with all internal and external third-party systems that hold the collected data. It streamlines communication between disparate databases, particularly regarding sensitive, personally-identifying information.

Data maps can help bridge informational gaps and standardize enterprise data. A comprehensive data map can tell you where data is stored, how it’s stored, and, most importantly, how it all connects.

With this knowledge, you can bolster your enterprise-wide data practices allowing you to:

Record information accurately
Prevent errors and redundancies
Secure your sensitive data
Prepare for data reporting

What Is the Purpose of Data Mapping?

At its core, the purpose of data mapping is to provide an essential overview of all the data inventory generated in and flowing through an organization. It’s a critical component for any modern company’s privacy program that aims to comply with regulations requiring you to know what data your organization collects and how you process and use data.

Data mapping is an essential compliance measure for companies beholden to data privacy laws, like the GDPR, CCPA, VCDPA, and CPRA.

With a robust data map, you can provide answers to questions regarding:

Source(s) of data ingestion (e.g. a marketing form)
What data set you’re collecting (e.g. name, phone, and email)
The purpose of the data (e.g. send relevant communication over email)
The handling of the data (e.g. store the information in Oracle Marketing Cloud and sync the consumer to Salesforce)
The retention timeline of the data (e.g. if the individual doesn’t purchase after 6 months, delete this information)

Why Does Data Mapping Matter?

Businesses hold plenty of sensitive data (personal information), and customer data is only a small piece of it.

More to the point, not every bit of data is equal. Some information proves more critical than others and requires more protection. Some data is shared, repeated, used, or stored in multiple locations. Different parts of organizations will use the same bits of information in different ways.

If data is mapped improperly, it could be corrupted or lost en route to its destination. To be useful, the data map must be more than a static snapshot of a point in time. It needs to be actively maintained as your organization grows and evolves.

Robust data mapping is an integral first step for several data-related use cases, including:

Data Migration: A one-time transfer of data from a legacy system to a new source. Once moved, the original data source is retired.
Data Integration: A continuous process of transferring data from one system to another, typically triggered by a specified event or as part of a scheduled timeline.
Data Transformation: A process of converting data from a source format to the new destination’s format. Examples of this include deleting redundancies or duplicates, removing nulls, enriching the data, or changing the data type.
Data Warehousing: Pools all the data into a singular source for analysis, queries, or reports. Data in a data warehouse has already undergone the three processes above.
Data Audits: Maintain a detailed record of audit trails, logs, and records of processing activities (RoPAs) to identify errors and continuously optimize the data mapping process easily.
Privacy Assessments: A data map provides a comprehensive inventory of collected and held data in order to properly conduct Privacy Impact Assessments (PIAs)/Data Protection Impact Assessments (DPIAs). These assessments help identify privacy requirements for a new product, project, or activity, and any changes to a company’s privacy practices, policies, or promises.

The Data Mapping Process

What does the data mapping process look like? The specifics vary depending on the organization, its systems, the breadth and scope of its data, and whether it leverages automated tools.

The below process is a typical workflow for companies using a manual data mapping program.

Identifying Data Sources: Start with identifying all collected data and data sources. This is critical for preventing data loss, upholding data accuracy, and determining the correct data sets, data fields, data sources, and inputs involved in the process. Organizations constantly gather data from various sources like marketing forms or payment interfaces.
Classifying Data: Organizations should use data classification to understand exactly where customer data and other sensitive information lives, who has access, and how it’s processed. This allows companies to improve their data management practices and apply appropriate safeguards and data access controls.
Mapping Data Flows: Identify and map data flows and match different source data fields to their destination fields so there’s alignment between the two. If doing this manually, maintaining logs and monitoring the process helps prevent errors or data bottlenecks.
Analyzing Risks: Once data flows are mapped, it’s important to review and analyze risks related to the collected data and deploy safe data management practices. Review different sources of data to ensure that all third-party app data integrations are able to keep sensitive data safe.
Ongoing Maintenance, Updates, and Documentation: Data maps are dynamic, not static. They require constant maintenance, updates, and changes when new data sources are added or changed.

Data Mapping Techniques

Direct Mapping: Mapping data fields directly from source to target without any transformation or modification
Concatenation: Combining multiple data fields from the source into a single target field
Lookup Tables: Replacing or mapping source data values to corresponding values in the target system using a lookup table
Data Transformation: Manipulating or converting data during the mapping process, such as cleansing, aggregation, or calculations
Conditional Mapping: Mapping between source and target fields based on specific conditions or rules
Schema Mapping: Mapping the overall structure or schema of the source data to the target data structure
Field-Level Mapping: Mapping individual data fields from the source to their corresponding fields in the target system
Hierarchical Mapping: Mapping parent-child relationships and maintaining hierarchical structures in nested data formats
Semi-Automated Data Mapping: Combining manual mapping with automated suggestions or recommendations from machine learning algorithms
Template-Based Mapping: Using pre-defined templates or mappings for commonly encountered mapping scenarios
Metadata-Driven Mapping: Utilizing metadata about the source and target data to guide the mapping process
Automated Data Mapping: Automated data mapping processes allow employees to focus their time and energy elsewhere.

Data Mapping Best Practices

Organizations can address the challenges present in data mapping through a few best practices:

Provide a Top-Down Approach: For data mapping to be effective, leadership must buy in as part of the Privacy by Design program.
Prioritize Sensitive Data: Carefully consider what personal data requires higher levels of protection.
Leverage Software: Integrate data map maintenance into software development processes.
Invest in a Privacy Solution: Ideally, you need a privacy solution that features data mapping tools at its core.

Ensuring Data Quality and Addressing Challenges

Continual data mapping helps to improve and maintain data quality for your organization. This is vital for stakeholder verification and validation when fulfilling data subject requests (DSRs).

However, data mapping can present three major challenges:

Complexity: As the amount of data and sources increase, the mapping process becomes exponentially more complex and time-consuming, especially using manual processes.
Sheer Volume: The massive volume of data that businesses collect can present a large issue for data mapping, especially if the mapping is manual.
Evolving Nature: Data maps should be living documents that require constant maintenance.

Data Map Regulatory Requirements

The EU’s privacy law, the General Data Protection Regulation(GDPR), directly addresses data mapping in Article 30, stating in part:

Each controller and, where applicable, the controller’s representative shall maintain a record of data processing activities (RoPA) under its responsibility.
The controller or the processor and, where applicable, the controller’s or the processor’s representative shall make the record available to the supervisory authority on requests.

Finding the Right Data Mapping Tool

While the word “map” may imply a visual representation of data systems in use at your company, a data map is often just a table of information.

While manual data mapping is possible at a smaller scale, the sheer volume of data makes such an undertaking inefficient and unreliable.

What Should You Look For in a Data Mapping Tool?

Automated data mapping tools can help improve mapping accuracy and efficiency. Some features to look for include:

A Live Data Map: An easy, visual representation can illuminate complex mapping and data flows.
Automated DSR Fulfillment: The best data maps help fulfill privacy requests by leveraging machine learning-based tools.
Data Format Support: Organizations often have various data formats and systems housing their held source data and require a system that can support a wide array of different data formats.
Automatic Updates: Data mapping programs should leverage automation whenever possible.
Audit Trails: The system should maintain a detailed record of audit trails, logs, and records of processing activities (RoPAs).
A Comprehensive Privacy Dashboard: Data mapping gathers important business information across all systems.

Table of Contents