Data flow map

Create objects

1. Click Data flow map from the left navigation panel.

2. Create your first object by selecting Create object from the toolbox.

Note

PrivacyDesigner has six different kinds of objects that can be used on the data flow map:

• Data Subject Category (e.g. Customer)
• System
• Storage
• Customer service
• Personnel role
• Organization

Read more about assessment objects in Objects.

3. Select Data subject category as the Object type and enter a Title for the object.

Tip

We strongly recommend starting to draw assessments from a data subject category object.

4. Click Create.

5. Create all the objects that relate to the assessment’s data processing activities, read more about assessment objects in Objects.

6. Connect objects together, read more about data flow in Data flow.

Describe an object

7. To observe an object, double click it in the data flow map. (Customer is viewed here.)

Tip

Edit assessment-specific information modifies only the assessment-specific description of the object. Edit general information changes the object’s general description in all assessments.

8. Describe how the object is relevant in the assessment.

9. Check with Preview how the description will look.

Note

This description widget supports markdown syntax. Below is an example of how the text can be formatted. Click preview to check the text. It is also possible to use hyperlinks in markdown to link to other services and documentation.

10. To save your changes click Save.

Add data types

11. To add data types and data categories, navigate to the Processed data tab.

12. Click + Add data types.

13. If the data type you need has not been created yet, click + Create data types to open the creation dialog.

Note

Data types represent data subjects’ personal data that is processed.

14. Name the data type and optionally select a category for each data type. Select Special category for data types that belong to the special categories of personal data.

15. Click Add new to create multiple data types at once.

16. If a category does not exist yet, type its name in the Category field and click create new one.

17. Name the category and optionally select a parent category for it. This creates a hierarchy similar to that of assessments.

18. Click Create to save the category.

Note

Examples of different kinds of data type categories:

• Employment information
• Purchase information
• Customer data
• Behavioral information
• Medical and Health data
• Communicational information
• Tracking data
• Economic and financial data
• Permissions & consents

19. Once you are done with creating data types and categories, click Create in the data type dialog.

Note

Created data types can now be added to the Customer object (data subject category).

20. The created data types are now listed in the Add data types dialog.

21. Select all data types that are processed in this assessment.

22. Click Save & exit.

Caution

Selected data types are now personal data linked to the Customer object (data subject category) in the Customer Support assessment. All the data types that are created will be available in all assessments for all users. Make sure to look for existing data types before creating new ones.

The ⚠ column shows whether a data type belongs to the special categories of personal data.

Note

As the Customer object (data subject category) now has personal data linked to it, the data can be added to connections that were created earlier.

Link processed data to connections

23. Close the form by clicking the “X” in the top-right corner of the object window.

24. Notice that you can now see the number “7” in a blue label in the Customer object, which represents the number of processed data types in that object. Next, double click the connection originating from the Customer object (data subject category).

Note

Processed data types

Processed data types (PDT) are different from data types in that they are specific occurrences of data types in the objects of an assessment. Processed data types have their own ID #s, and are differentiated from each other by data type (e.g. “Name” or “IP Address”), data subject category (e.g. “Customer” or “Employee”), data source (e.g. “Website” or “Customer Service Desk”), and route (the lineage of objects via which it has arrived at its destination object).

25. Click Edit to define which processed data types are flowing in the selected connection between Customer and Super System.

26. Select from the available processed data types.

Note

Transferring person is a personnel role object that is part of the data processing activities. See section Data flow - Transfer access for more information.

27. Click Save.

28. Return to the data flow map by clicking the “X”.

29. Repeat steps 23–28 to insert processed data types to each connection line.

Note

If there are no data types available, check steps 12–22 and the previous connection lines, to make sure that the data is correctly linked to the data subject category and flowing forward in each connection line.

30. Once you have finalized the data-flow map, there should be at least one processed data type in each object in the data-flow map.

31. Notice that in the Processed Data tab of objects (and inside connection lines), you can expand the processed data type rows with the blue arrow icon in the far-left column, which reveals the specific processed data types (ID, data type, category, data subject category, data source, and data lineage). You can also click the blue labels with a number in them to reveal the route of each processed data type.

32. The same logic works inside connection lines’ processed data types tables. Notice that you can also deselect specific processed data types, so that they no longer flow between the objects.