Data Maps: What Is It And The Best Techniques and Tools

Since the inception of GDPR, millions of companies around the globe are racing to implement data privacy programs to demonstrate compliance to regulators, and keep up with the on-going demand of privacy requirements from their customers.

Consumers and laws are demanding companies understand how personal data is handled, and where it might exist. An up-to-date data map is vital for compliance with the new wave of privacy laws such as GDPR in Europe, or CCPA in the United States.

In order to get a holistic view of where to start and what’s required, organizations must understand what aspects of their organization may have privacy requirements, or need addressing. Depending on the company, there could be few or many areas that will need coverage when operating your privacy program. The data map helps establish what these areas and requirements are.

The starting point for many privacy programs around the globe is beginning to document your personal data across your organization. This can be extremely challenging if you are taking on this task while your business has been operating for several years. In this article, we cover exactly how to kick off this process.

What is a data map?

There are a few terms that industry folks might refer to when referencing data mapping including data flow, Records of Processing, GDPR Article 30, data inventory, or CCPA personally identifiable information disclosure. These terms are interchangeable, and the concept is the same: a thorough understanding or documentation of how your company processes personal data, and how it flows in or out of your organization.

A good way to think of your data map is the who, why, and what around your data processing. In a nutshell, the data mapping process and documentation uncovers some important questions for your privacy program:

• What personal data does my company collect?
• How long does my company retain this data for, and how do we delete it?
• Why does my company collect and process this data?
• How does my company process this data?
• Where does this data come from?
• If digital, what business system hosts this data?
• Where does this data geographically reside?
• Who do we share this data with?

The objective of your data mapping documentation is to provide a high-level overview of every piece of personal data in your business databases. Although the idea of data mapping seems obvious, building one can be daunting, cumbersome, and complex. Companies add new departments as they grow, and often we see silos created across the organization, making recording different 3rd party systems and vendors very difficult to manage, and governance becomes a nightmare.

Can you just do this later and as you go? Absolutely not. Especially if you do business in jurisdictions like Europe or California. If you don’t know what personal data exists, and where - demonstrating compliance is impossible since you won’t know where to start if you have a data breach or a data subject request due in a few days before it’s in violation.

Why do you need a data map?

Data continues to become more essential as companies modernize and scale up. Your company will continue to lean on data more and more to drive business decisions and  increase revenue. Concurrently, more and more data privacy legislation is being introduced around the globe making compliance more complex. At the base of each legislation, your data map will be a tool to help you map what your compliance requirements are.

Compliance

The data map is often the starting point for privacy program kick-offs, and often cost of compliance is used as the key driver. The cost of compliance could be hefty. Since the inception of Europe’s GDPR, we’ve seen over $300M in fines issued from European countries to businesses worldwide. These fines are not looking to slow down anytime soon, and will continue to accelerate as new regulations roll out.

Increased Revenue, Shorter Sales Cycles

A recent survey from Cisco shows that 74% of consumers won’t purchase products that don’t adhere to consumer privacy. Businesses that have privacy compliance and programs already, are seeing as much as a 90% drop in their B2B sales cycle duration. 

When winning over B2B vendor deals, or trying to win over customers - having a data map becomes important, so you can have context on your businesses data processing to help with vendor questionnaires, policy notices, and contract development.

Brand Trust

75% of shoppers will prioritize brand trust over price when purchasing a product. Providing privacy assurances and disclosing them to your customers will help your customers understand that their personal data is respected at all times.

What does a data map look like?

A data map should contain (at minimum) some high level information about personal data and how your business processes it. It’s not the exhaustive list of detail you might need to account for, but it’s a great starting point for your first data map to comply with laws such as GDPR or CCPA. This document is often produced as a spreadsheet.

If you don’t want to create your own, you can use our template that can be exported from our Automated Data Mapping tool.

If you’d like to know how to do this in an automated way, reach out to us for a demonstration of our Automated Data Mapping tool.

How do I kick-off the data mapping process?

This process can look different depending on the size, culture, and other factors affecting each business. Below is a suggested list of high-level steps to kick-off the process operationally.

1. Find a DPO / CPO
   The first step is to identify the individual who will maintain your company’s data map to help ensure compliance with the applicable privacy laws for your business. Your company may have appointed one already, but typically we see someone with a legal or technical background take on this role part-time at small-medium businesses. The larger your company grows, the more demand there will be for a dedicated resource in this position. Article 37 of the GDPR has a great overview of what’s required by a Data Protection Officer or Chief Privacy Officer.
   
2. Understand where and what data exists
   This is when the fun starts. At a small organization with 5 or fewer systems that hold personal data - this is a lot easier. We suggest going through your finances or reaching out to whomever is in charge of implementing IT systems to find out what systems or places you might hold personal data.
   
   As your company grows, and you begin to scale out your departments, you’re going to want to follow steps 3 - 5.
   
3. Prioritize & determine key points-of-contact
   We suggest starting with an organizational map. Create a list noting down all the heads of departments or functions across your organization, their role, department, and contact information.
   
   Look through this list and come up with a hypothesis of which departments would collect the most amount of personal data. Typically, we see engineering, marketing, and sales departments with the highest volume of processing personal data, but this might be different for your organization.
   
   Organize your list from top to bottom, with what you think is the highest processing volume, to the lowest.
   Once you have this list, we suggest reaching out to the heads of these departments to start socializing your privacy program and sharing context. The sooner you can get buy-in, the better! We don’t go deep into getting buy-in or stakeholder alignment in this article, as this is a topic of its own.
   
4. Manual surveys & questionnaires
   You’re now ready to kick off your privacy program, and we find it’s easiest to discover what information exists by sending out a survey or questionnaire to each department to find out what data systems they might have, what processes collect data, and understand why they collect it.
   These questionnaires are often 10 - 20 questions long, and we find the simpler the questions, the better. Here are some great high-level questions to answer on your questionnaire:
   
   - What are the different data types you collect?
   - Why are you collecting / processing this data?
   - Do you receive explicit permission to process this data?
   - What other teams and functions have access to this data?
   - How long do you retain this data?
   - What is the reason for retaining this data for this period of time?
   - Where does the data exist?
   
5. Automated tools
   Does all of this seem too manual? You’re right - it is. And the challenge is that this is a recurring process and can cost your organization hundreds of thousands of dollars each year to maintain.
   
   After a while, you’ll notice teams fall out of process, and don’t submit questionnaires as it’s a burden to their process. Companies want to move fast, implementing new tools to kick-off campaigns, or ship that new product feature quickly, so they will just skip the privacy process. Before you know it, there will be shadow systems across your business, and you won’t even know it.
   
   This is when an automation tool comes in.
   
   What if each time a system was added to your network, you received an alert, and could automatically invite those key points-of-contact to help answer questions needed for your data map? Imagine the automation tool detected the different systems as they were on-boarded, and connected to these different systems to see what data exists? This would allow you to move from a reactive process to a proactive process, and make developing your data map a breeze.
   
   That’s where a tool like Opsware comes in. Solutions like Opsware help organizations reduce overhead, minimize their compliance risk, and increase efficiency. Especially so for organizations who don’t have the luxury of a dedicated Data Protection Officer or Chief Privacy Officer. This makes demonstrating compliance dead simple. With our solution, you can produce a real-time data map in just a single click.
   
   For organizations with a dedicated Data Protection Officer or Chief Privacy Officer, automation tools allow them to focus on other privacy initiatives such as keeping their data secure, awareness training, conducting audits, and enforcing other key policies.

Maintaining Your Data Map

The data map document and process is typically best when it’s shared and collaborative across your organization. As you can imagine, maintaining this data map becomes very challenging as your business grows, and often turns into a reactive process, instead of proactive. As mentioned in this article, implementing a process where team members fill out a quick questionnaire when building out a new company process, or software feature is one way to stay ahead of data mapping.

It’s important to have your assigned Data Protection Officer (or Chief Privacy Officer) maintain and own this document. Opsware offers a great tool to help kick off this data mapping process and aspects of automation that remove the burden from you and your teams. 

We hope this article has been helpful in helping you kick off your company’s data map, and sharing some context on a few of the many things that could be required.