Map data flows and responsibilities

Lista de acciones

1. 01

   Describe purposes

   For each use, document the purpose, affected people and necessary data. Identify collection without a clear purpose and unnecessary copies. Start with a concrete operation, such as answering a contact request. Identify what is essential for that response and what serves another purpose. Avoid letting a broad label hide several distinct purposes and data paths.

2. 02

   Trace data flows

   Map transfers between applications, providers and countries. Include backups, manual exports, logs and AI tools used by teams. Trace one case end to end with tool owners. Include attachments, local spreadsheets and automated integrations. Distinguish hosting location, access location and contracting entities; these describe different things.

3. 03

   Name accountable owners

   Clarify who decides purposes, operates systems and validates requests. Connect contracts and responsibilities to observed processing. For each change, assign someone to decide and someone to verify implementation. A contract establishes a framework; checks must also examine actual access and the subprocessors really used.

4. 04

   Define retention and access

   Set documented retention periods and verify implementation. Limit access by role and test deletion with a case including copies and justified exceptions. A retention rule is more than a value in a policy. Test an expired record, identify remaining copies and document exceptions. Backup arrangements require an appropriate, verifiable procedure.

5. 05

   Review risks

   Assess the consequences of disclosure, alteration or unavailability. Have responsible specialists review impact assessment requirements and international transfers. Describe affected people, usage context and potential consequences before classifying a risk. Have competent specialists validate legal questions. Retain the reasoning behind the chosen action and its limitations.

6. 06

   Maintain evidence

   Retain approvals, changes and tests. Review access requests, incidents and supplier changes at defined intervals. Review the map when adopting a tool, adding an export or introducing AI use. Preserve the request, approval and post-change test. A useful register reflects actual operations rather than an initial theoretical state.

   Worked example: a team stores customer requests in a SaaS platform and working exports. To test retention, trace a representative record through relevant copies, logs and backups. Distinguish immediate deletion, delayed expiry and justified retention. Record exceptions and remaining access rather than claiming complete deletion because the record disappears from the interface.