Prepare for GDPR by following our step-by-step guide to GDPR data mapping.

The General Data Protection Regulation (GDPR), the largest change to data protection law since the 1998 Data Protection Act, comes into force in under two months time. Is your business GDPR-ready?

Since the primary concern of GDPR is personal data, one of the first steps towards compliance is to carry out data mapping to identify what personal data you hold, where it came from and who you share it with. Personal data must be stored securely, used strictly for legitimate purposes, and only kept for as long as it is needed.

GDPR data mapping

1. Identify and list what systems (assets) you use  – e.g. online accounting system, paper HR system, digital CRM system
2. Fully document each system:
   • What’s the system used for?
   • What data does it contain?
   • What security is in place?
   • How essential is the data?
   • Is the data held externally? Where?
   • How long do you keep the data?
   • How does the system provider safeguard your data?
3. Identify and list your data processes
4. Fully document each process:
   • Why is the data collected?
   • Is it personal data?
   • How was the data obtained?
   • Is the data encrypted?
   • Is the data shared internally?
   • Is the data shared externally?
5. Identify the gaps in your systems and processes:
   • Update your processes and policies
   • Educate your staff
   • Implement data security solutions  – e.g. two-factor authentication, antivirus, email filtering

By following this data mapping process, you will have a full understanding of what data your business holds to ensure it is processed and stored safely.

If you’d like any assistance with GDPR data mapping, please get in touch. We have completed the process for our business and are now working alongside clients to assist them. Please call us on 01392 207194, or drop us an email.