With Data Mapping, we gain a deep understanding of the 5 stages that every piece of data goes through within any department of a company, regardless of its size or industry. Again, my dear friend, you don't need to be a PhD in PMBOK or Project Management to understand these crucial stages! Data Mapping and Data Inventory have become one of the most essential tools for Data Protection Officers (DPOs)!

The market today has brought a lot of technology and quality to these processes! We have no complaints about that. But my goal here today is to teach you to see things in a simpler and more objective way, as they truly are – a straightforward arrangement of facts, and that will already help you.

So, let's get started!

A basic concept that will guide your understanding from now on:

## **With the grouping of processes, we have a department.**

Therefore, each process can be organized in an order, or not, thus forming the routines of the departments.

Thus, for each process in your company, the following 5 points can be fulfilled in full or in part.

They are:

1. #### Motivation - Why do we need this data?

2. #### 2.1 – Consent.

3. #### Processing / Treatment
    
    #### 1 – Internal sharing among departments and systems.
    
    #### 3.2 – Storage for internal use and consultation.
    
    #### 3.3 – Backup.
    
4. #### Disposal

5. #### End of the process?

_And what do I do with these 5 points above?_

### **Fill them in and structure this logic in all your processes and consequently, departments.**

Yes, it's hard, I know!

But, it will be extremely valuable in case of a notification from the National Data Protection Authority (ANPD) or even before that, in case a customer or visitor to your website asks for access to the data you may have about them.

Of course, if you're a small business or have very few employees and processes, all of this can be summed up in 3 or 4 systems (email, marketing automation, some Google Drive, and accounting) because everything is stored in these places. Now, imagine a company with 500 employees in 10 cities.

Remember, according to LGPD, any data subject can knock on your door asking if you have any of their data, and you must respond promptly.

So, without the "treasure map," how will you know that [name@personalemail.com](mailto:name@personalemail.com) subscribed to the Newsletter, made a purchase 3 months ago, and was your employee 5 years ago?

In the above example, you would have to report to that person that you have data such as:

\- Name, Email, CPF, Phone, Address, Work Permit, Parentage (HR data), and sharing with Google and Facebook.

For the following reasons:  
1- Hiring in the past, so labor legislation obliges you to keep this data in your accounting for X years. In other words, even if he requests deletion, you can deny it, due to another legislation.

2 - Purchase of products X, Y, Z 3 months ago.  
This also generated registration in the newsletter (with the famous "I accept to receive promotions"). From the newsletter, you have him on the mailing list for new products and updates from your e-commerce, and all remarketing tools are connected, pursuing him daily across the internet, every time he visits to see your products.

Therefore, he can freely request the deletion of all his data for marketing purposes. This will lead to a series of actions. These include:

\- Deleting the email and other data in the CRM and email delivery tool.  
\- Distributing the Opt-out request to any systems you are integrated with that use this data. (logistics and ERP systems, for example)  
\- Removing him from the Google and Facebook remarketing segment.  
\- Reporting in an official company document that the above steps were promptly completed.

(For AdOpt clients, when integrated with Tag Manager, the cookie part becomes much easier! Because when a visitor does not authorize some of them, AdOpt automatically blocks this firing!  

[Here's a tutorial for you!](https://goadopt.io/en/support/essential-setups/3rd-party-cookie-blocking/manual-third-party-tag-blocking/)

Additionally, a visitor's request on the opt-out page sends an email to you immediately, with this request linking the requester's email to the Cookie ID generated in the Opt-In.

So, you can start this search with greater direction if the requester has given consent to any tools and when.

Do you understand now the importance of mapping your company's processes?

Only with all this in hand will you have peace of mind and, more importantly, ease of accessing all this data promptly. For some companies, around 48 to 72 hours (a reasonable response time...) is more than enough, for others, it's practically impossible.

Whether you or your hired DPO, we can't stop the company for every request from a visitor. With Data Mapping in hand, this search is much faster, targeted, and, I dare say, automated, if you use software just for that.

Here's a more detailed breakdown of each of the points in Data Mapping:

1. **Motivation - Why do we need this data?** If LGPD hasn't already prompted you and your company to reflect on the real need for personal data in your business, stop and do it as soon as possible.

    Yes! Often, especially in Marketing and Sales, there's a compulsion for qualification and identification information about prospects and leads for each stage of the funnel. It's great to pick up the phone and close the final details of a sale or surprise an undecided customer and convince them of the value of your business.

    But the point I emphasize is: Reconsider the real needs of accessing, processing, and storing this data. You don't necessarily need to have an Excel sheet with thousands of lines of your inactive customers from 5 years ago, hoping to rekindle this dead list one day. In light of LGPD, your risk has already been measured; is it worth it?

    [In this article, I present 10 marketing processes that you should rethink in light of LGPD!](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/)

2. **Collection**.  
    What are the ways in which each process collects/receives your data, along with your consent? Do all data enter the company through a single entry point, or more than one?

    List them all and review whether each entry point displays the necessary policy and process communications, and whether consents from each data subject are also collected alongside the data. Even if in an analog/offline manner, consent is essential.  
    1 – Consent.  
    Yes, consent is essential, but it's not the only instrument that allows you to access or process personal data.

    In this [article, we list all the legal bases](https://goadopt.io/blog/en/legal-bases-of-lgpd/) that support the use of personal data according to LGPD.

3. **Processing / Treatment**  
    1 – Internal sharing among departments and systems.  
    - Are third-party software used for data processing?  
    - How do data flow between them?  
    - Is the software aligned with your process and privacy policy?  
    - If a data subject requests the deletion of their personal data from your company, how do you notify this external or internal supplier to process the deletion?

    - Is there any documentation or search tool to assist the DPO in case of scanning, making it easy to locate data of a data subject in the department?

    3.2 – Storage for internal use and consultation.

    - During the processes where data is stored?  
    - For how long?  
    - Files, physical hard drives, or in the cloud?  
    - Is this cloud in the national or international territory?  
    - Who will be responsible for deleting or querying the database in case of a request?

    - Is there any documentation or search tool to assist the DPO in case of scanning, making it easy to locate data of a data subject in the department?

    3.3 – Backup.  
    - What is the frequency and rules for backup?  
    - Files, physical hard drives, or in the cloud?  
    - Is this cloud in the national or international territory?  
    - Who will be responsible for deleting or querying the database in case of a request?

    - Is there any documentation or search tool to assist the DPO in case of scanning, making it easy to locate data of a data subject in the department?

4. **Disposal**  
    Although greatly facilitated for digital files, this stage of the process is quite serious. Many files remain in the "trash" and are not properly deleted.  
    For physical files, this problem is even greater when disposal is done poorly or neglected.  
    Understand this process and, especially if there are third parties involved in the stage, include them in your monitoring of third parties potentially involved.

5. **End of the process?**  
    Is the end of the process indeed the end of the data's journey in the company, or is it just the beginning of another?

Certainly, at first glance, all these questions and concerns may seem excessive. But believe me, these are just some of the questions you would/have to answer if you hire a consulting and compliance service.

Or, in a scenario not as informal as this text, a visit from the ANPD.

I hope I have helped you gain a better understanding of how these stages are essential in a DPO's routine.  
With Data Mapping, we certainly have the foundation for creating a more robust privacy policy.

Did you miss any items or descriptions?  
Send them our way; we are open to improvements, always! - You can send them to hey@goadopt.io

A recommended further reading to delve deeper into the subject is:

[The differences between Data Controller and Data Processor.](https://goadopt.io/blog/en/differences-operator-controller-of-data-lgpd/)


Data Mapping or Data Inventory - a life jacket for the DPO!

João Bruno Soares

How do you deal with a profession that didn't even exist a few years ago and is now mandatory in companies? That's precisely the question that arises when we think of the [Data Protection Officer or DPO](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/).

This term, as well as the professional behind it, emerged with the enactment of privacy laws, in Brazil, the [General Data Protection Law - LGPD.](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) This law was enacted in 2018 and only came into effect in 2020. According to the law, they are responsible for ensuring the correct treatment of data that the company may use, which belongs to third parties.

And this responsibility assigned by the law to the professional figure of the Data Protection Officer may lead to the assumption that they are the sole and exclusive responsible party for the care that applies to such data. Is that the case? Is the job of the Data Protection Officer solitary or should it be a team effort? Find out all of this in the following sections.

## Data Protection Officer and Their Responsibilities

You know those lists where we see "future professions"? Well, if we considered 2021 as the future, the figure of the Data Protection Officer would be on that list because, in professional terms, it's one of the newest and most modern roles in the market.

After all, this position didn't even exist before LGPD or GDPR. The law created a new profession. This happened the moment the General Data Protection Law explicitly established the existence of this figure. At the same time, it laid out all of their responsibilities.

The Data Protection Officer or DPO (_Data Protection Officer_) is precisely a figure who must control and manage data processing - in other words, their use - in the day-to-day operations of the company. Thus, they are responsible for ensuring that all processes, flows, and actions respect the limits supported by the Legal Basis that underpins the use of that data by the company. Therefore, in the event of an inquiry from ANPD to the company, they are the ones who must respond on behalf of the institution.

### Learn more about the Legal Bases of LGPD.

Among the responsibilities of the DPO that are clearly stated in LGPD are:

- Execute tasks determined by the Data Controller and within the limits of that determination (and, of course, the law);
- Handle complaints from data subjects;
- Provide explanations about the use of data to data subjects;
- Communicate with data subjects whenever necessary;
- Take the necessary steps to reflect changes in data use and collection due to changes in the data subject's consent;
- Guide other professionals who handle this data and instruct them regarding security measures and the limits of consent and the application of this information.

By responding to the guidelines of the [Data Controller](https://goadopt.io/blog/en/differences-operator-controller-of-data-lgpd/), the DPO is not to be confused with this figure. While the controller refers to the one who defines the mode of treatment of information from its entry to its elimination, the Data Operator is the one who executes the process and ensures that it is strictly followed. When distinct, both the Controller and the Operator must have their respective DPOs.

### [Learn more about the responsibilities of the Data Protection Officer and how their work impacts companies in light of the General Data Protection Law](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/)

## All teamwork clichés become a reality in data treatment care as per LGPD.

There are several responsibilities that a DPO has within a company, as we've seen above. And this doesn't happen by chance, as data processing imposes specific limits and requires essential attention and care.

In this sense, it becomes clear that the Data Protection Officer accumulates a series of activities. But, no matter how well-equipped they are for their responsibilities and how up-to-date they are with the company's data processing activities, it's not enough.

_The isolated work of the DPO is something that is impossible to occur._

Or rather, it finds no possibilities of developing with the necessary quality and maintaining security against data leaks or improper use.

That's why when we talk about the work of the Data Protection Officer, we cannot understand that their activities are carried out in isolation or individually. The importance and number of responsibilities make their work a team effort.

To avoid any confusion, understand this: the DPO really is responsible for the issues involving data use. Thus, in the event of accidents or problems involving this information, they will be directly involved.

On the other hand, this does not mean that they should work alone. Quite the opposite! Ensuring that other employees and teams are involved in the care required by data processing due to LGPD is crucial.

The work of the Data Protection Officer is multidisciplinary. Legal, Technology, [Marketing](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/), Information Security, Process Management, Institutional Relations, etc. Since it's very difficult for one person to master all of these areas, the assistance of a support team is essential!

Only in this way is it possible to develop work in harmony, which takes place jointly to ensure the correct use of data. Therefore, don't isolate your DPO! Their work should take place close to other employees and with their assistance.

## Formation of a data security committee

One way to provide the Data Protection Officer with the support they need to carry out their activities successfully is to create a data security committee. It should be formed by various professionals representing the company's teams.

Moreover, they should represent the main interests involved when we are faced with data leaks or misuse. Therefore, it should have representatives from Human Resources, the Legal department, and Information Technology, at a minimum.

Likewise, they can include, regularly or in specific situations, representatives from the marketing team, as well as from the Communication, Sales, Finance departments...

With this, the DPO finds opportunities to jointly develop strategies, with each department's representatives helping with their implementation, as well as mapping the main problems that data processing encounters in various business processes.

Each representative acts as a direct extension of the DPO in their department(s), so it is important that they have a good understanding of the processes and autonomy in investigating flows and details.

## Knowledge of the company's data processing-based processes

As we've seen, the DPO is responsible for ensuring that data use occurs in accordance with the [legal basis](https://goadopt.io/blog/en/legal-bases-of-lgpd/) that supports the use of user data and within the limits of LGPD. Also, they must faithfully follow the instructions of the Data Controller.

There are numerous types of activities that occur simultaneously within a company that involve data processing. Consider, in this regard, an online sale. In this case, data such as address, CPF, phone number, and full name are collected, which should be used for:

- Billing;
- Generating invoices;
- Communicating the completion of the sale to the customer;
- Logistics for the separation and forwarding of the product;
- Offering tracking;
- Post-sale contact.
- ...

And these are just some of the activities that require data in a sales process. Therefore, it is necessary for the Data Protection Officer to be familiar with these processes, how they work, the data they use, how they are stored, discarded, and other such information.

Only in this way is it possible to know where the company is succeeding and failing in data processing, as well as to develop security strategies and ensure that data processing takes place within its limits and regulations.

## Establishing Limits and Rules for Data Use by Teams

Ideas and possibilities abound.
But to try to conclude this topic, one last tip.

When the DPO is in contact with the teams, they also become capable of guiding them so that, in their day-to-day activities, data processing occurs correctly. This can be done in various ways, such as through the development of a manual, training, etc.

It is crucial that everyone who in some way works with data processing has access to such standards and knows exactly what the limits of information use are.

With this, the teamwork of the Data Protection Officer not only becomes possible but also brings effective improvements to the company and makes it secure in compliance with LGPD guidelines.

Have you heard of [ROPA in LGPD](https://goadopt.io/blog/en/ropa-for-lgpd/), do you know what this document is?

Here, we talk a bit more about it, to help you with [compliance processes](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/).

Data Mapping or Data Inventory - a life jacket for the DPO!

Data Protection Officer and LGPD, a Solitary or Teamwork Job?

Oregon OCPA and Cookies: All You Need to Know