Intro to Data Mapping

  • Updated

User Roles

  • Data Mapping Manager - Read/Write access to all data mapping capabilities. 
  • Data Mapping Viewer - Read access to data map.

 

How do I set up my data map?

Your data map in Osano is a visual representation of information contained on your data stores.

The information contained here...

 

Data Map

 

...is just another way of looking at the underlying information on each of the data stores listed here:

 

Data Stores

 

Setting up your data map is therefore a matter of populating the information you want to visualize on the data store configuration pages of each data store you'd like to appear on the data map:

 

Data Store Config

 

The best way to proceed with setting up your data map will depend on the current state of the information contained on each of your data stores. It will also depend on the purpose or purposes you'd like your data map to serve. Generally speaking, there are three purposes for creating a data map:

  1. Enable subject rights processing
  2. Identify needed assessments
  3. Identify and mitigate risk

The steps outlined below for setting up your data map should enable you to deliver a first draft that can serve as a foundation for fulfilling any or all of the purposes above. However, which steps to take next to deliver an improved second draft of the data map will vary depending on the relative priority of the purposes listed above.

 

Step 1 - Identify all data stores to monitor

A good first step for setting up your data map is to identify a complete list of data stores you need to visualize on the data map.

At a minimum this will need to include all data stores your company is responsible for that may be processing personal information (PI). You may also want to identify data stores processing information that is not PI but still confidential.

If you've already created data stores in Osano this list can serve as one input.

In addition, if you've done some work outside of Osano identifying data stores you can import this list from CSV to make additional progress.

Ultimately, it is best to move from ad-hoc, one-off methods for identifying data stores that need to be monitored to systematic, repeatable methods. This is where Step 2 comes in.

 

Step 2 - Source identified data stores

Producing a reliable data map that does not become out of date immediately after being published requires setting up systematic, repeatable methods for sourcing the data map with the information needed to fulfill its intended purpose(s). You can set these systematic, repeatable methods by creating what Osano calls sources.

Broadly speaking there are two kinds of sources – systems and people. Sources differ in many ways. The best sources are responsive and reliable with broad knowledge about the information needed to populate your data map. 

We recommend beginning by creating two (2) sources for your data map, one reliant on a system to quickly identify the majority of the data stores you'd like to add to your data map, and the other reliant on people to identify any data stores not present in the system you connected to.

 

Step 3 - Review discovered applications

Once your sources have been set up, each source will serve as a systematic, repeatable method for sourcing the data map with information.

Sources reliant on systems will automatically sync with Osano every 24 hours and inform Osano of any new or updated information about the applications it finds.

Sources reliant on people on the other hand will inform Osano of any new or updated information about the applications reported by respondents each time a respondent finalizes any set of questions sent to them.

In both cases applications discovered by a system or reported by a person will display for review by a data mapping manager on the Applications page.

 

Step 4 - Add needed information to data stores

In setting up your initial sources you established systematic, repeatable methods for discovering where PI might be being processed. In reviewing these sources and assigning applications to data stores you in effect created a to-do list of data stores that require further review.

To see this list of data stores, navigate to the Data Stores page within the Data Mapping section of the left-hand navigation panel: 

Data Stores-1

The first thing you'll likely notice is the Completion column at the far right of each data store. The purpose of this column is to track progress toward adding the most important information needed for each of your data stores. For now, there are two tasks on each data store whose completion counts toward that data store's completion percentage (though this list will increase as we develop the product):

  1. Assign an Owner 
  2. Classify Fields

We've created a list of data stores that need to be monitored for PI. Now we need to assign owners to each of these data stores to identify who we can ask for any additional information we need.

Once owners have been identified, we need their help to populate and classify all of the data processed at that data store.

 

Step 5 - Visualize information on the data map

As soon as data stores are created, they can be visualized on the data map. However, without first populating created data stores with the information needed to fulfill your purpose, merely seeing blank data stores on a canvas won't accomplish very much.

To see your data map at any time navigate to the Data Map page within the Data Mapping section of the left-hand navigation panel: 

 

Data Map-1

 

By default, any data stores you have created that do not have established data flows or vendor relationships will display in the left-hand panel of the data map.

Any data stores that do have established data flows or vendor relationships on the other hand will instead display directly on the canvas of the data map itself (along with additional pieces of critical information about each data store):

 

Data Map

Adding data flow or vendor relationship information to your data stores is thus the final critical piece toward building the first draft of your data map. 

Once you've completed the above steps, you are well on your way to creating a data map for your organization. 

Related to