Data Mapping Automation Overview

Introduction to Data Mapping Automation

While many privacy regulations, including GDPR, CPRA, LGPD, PDPA, and POPIA explicitly require a data map or record of processing activities (ROPA) for compliance, having one in place also enables organizations to mitigate risk and effectively govern data use. With 90% of all the data in the world generated in the last two years alone, big data has become a big problem. Understanding how data is flowing through your organization is a prerequisite to being able to establish trust between businesses, employees, and consumers. A robust data map helps with essential privacy program obligations, such as fulfilling data subject requests, identifying data and individuals after a breach, populating PIAs, and generating compliance reports. Traditionally populated through manual tasks such as assessments and manual data entry, an automated data map increases accuracy and program efficiency and supports collaboration across other efforts within your organization.

OneTrust Data Mapping Automation creates a thorough map of your IT assets, processing activities, vendors, the relationships between them, and how personal data is processed within each. This map is automatically generated through AI-driven data discovery and classification, which surfaces both the business and regulatory context of the data and is supplemented through assessments and input from business subject matter experts. This enables automated risk flagging, policy enforcement, compliance reporting, and visualizations to drive privacy compliance and automated data governance.

Module Benefits:

  • Generate both visual data maps as well as compliance reporting like Article 30 records of processing (ROPA) with a single-click

  • Leverage the power of a single privacy platform to connect your data map with other critical privacy workflows

  • Auto-apply regulatory requirements to know what regulations and classifications are in scope across business systems and understand areas of overlap

  • Assess, track and report on privacy risk across assets, vendors, processing activities for projects or products

  • Generate visual data maps, compliance reporting and data lineage diagrams to understand the data lifecycle, relationships and dependencies

  • When responding to an incident, automatically pull information from the data map to quickly and accurately understand the nature and scope of the incident

Problems Solved by Data Mapping Automation:

Satisfy Regulatory Requirements

Meet specific regulatory requirements for records of processing, including GDPR, CPRA, LGPD, POPIA, and PDPA

Streamline Privacy Workflows

Automate the critical workstreams of your privacy program, including data subject rights requests, incident management, data retention, and more

Enable Data Governance

Build a foundational understanding of your data to enable compliant, ethical, and trusted data use

Typical Users

Admins or key users of Data Mapping would report to or have the following titles:

  • Data Protection Officer

  • Chief Information Officer

  • Chief Risk Officer

  • Chief Compliance Officer

  • Chief Ethics & Compliance Officer

  • Chief Legal Officer

  • Chief Privacy Officer

  • Chief Data Officer

Data Mapping Automation Module Terminology

Terminology

Terminology Context/Definition

Processing Activities

Any operation or set of operations that is performed on personal data, whether or not by automatic means.

ROPA Report

An organization's record of processing activities (RoPA), which refers to a requirement laid out in Article 30 of the GDPR, which states that a controller must "maintain a record of processing activities under its responsibility", including "all categories of processing activities."

Personally Identifiable Information (PII) / Personal Data

"Information that relates to an identified or identifiable individual." To be considered PII, data must not only identify, or make identifiable, an individual to whom it refers, but also "must concern the individual in some way." Management of sensitive personal data and PII often requires additional data protection requirements due to the sensitive and personal nature of the data and demands a considerable amount of attention, supervision and best practices to meet GDPR compliance.

Framework Examples

OneTrust Data Mapping Automation provides a solution that can help organizations fulfill the requirements to comply with many frameworks and certifications. Below is a list of some of the popular privacy frameworks that this module can help with.

Framework Description
GDPR The GDPR is the strongest global privacy law in effect today. Created by the European Union (EU) to regulate how organizations collect, handle, and protect personal data of EU residents. It also defines eight data subject rights that guarantee specific entitlements for individual's personal data. Ultimately giving individuals more autonomy over their personal information and how it is used.
Note: To learn more about the GDPR Framework, read our blog post here.
LGPD Brazil passed its General Personal Data Protection Law (LGPD) in 2018. The legislation establishes and protects the rights and freedoms of individuals and provides increased transparency to covered data subjects. The law contains unique definitions of personal data and their authorized uses that count on enforcement by the Brazilian Data Protection Authority (ANPD). Similar to the GDPR, the LGPD, or Lei Geral de Proteção de Dados, applies to the processing of data by organizations within Brazil, but also to organizations outside Brazil under certain circumstances. LGPD compliance provides significant benefits to data subjects who will be afforded new rights.
Note: To learn more about the LGPD Framework, read our blog post here.
PDPA The Thai PDPA outlines several requirements for data controllers, including that personal data is accurate, up-to-date, complete, and not misleading. It defines further requirements for processing certain types of personal information and upholding data subject rights. The Thai PDPA also has extra-territorial reach, meaning that organizations based outside of Thailand that offer goods or services or monitor the behavior of individuals in Thailand will fall under the scope of the law.
Note: To learn more about the Thai PDPA Framework, read our blog post here.
POPIA POPIA was signed into law in November 2013 and came into effect on July 1, 2020. The act enshrines the right to privacy and makes provision for a range of data subject rights, including the rights to notice of collection, to request the correction, destruction, or deletion of personal information, to object to direct marketing, to not be subject to automated processing, and to direct private right of action.
Note: To learn more about the POPIA Framework, read our blog post here.