We're opening an EU subsidiary, and legal wants a map of where personal data is stored, processed, backed up and accessed by vendors. Some services are EU-hosted but may still involve US processing or backups. What's a practical way to build the map, and what tends to get missed?
How do we map EU personal data across a US company's systems?
Asked by
mossy+toolkit_4
Answers
Start with a spreadsheet, one row per system or data flow, and trace the personal data rather than just listing applications. Record the data types, purpose, storage and processing locations, backups, recipients, subprocessors and any access from outside the EU. Add an owner, evidence source, review date and open questions so you can tell what is confirmed and what still needs checking.
A diagram can help show how systems connect, but it doesn't have to replace the inventory. Ask legal what detail they need for their records and review, then keep the map updated when systems or vendors change.
Reply to this answer
EU hosting is not the same thing as an EU-only data flow. Check redundancy, backups, support access, analytics, integrations and subprocessors. Ask vendors for specifics about your service and configuration, not just a general statement that they offer an EU region.
For older accounts, also verify the region actually in use. Moving a service may involve downtime and integration changes, and it may not eliminate every transfer outside the EU.
k29+foldingrule_704:
Backups are an easy one to miss. Check the actual destination in the infrastructure configuration, not just the location of the production system.
Reply to this answer
Get legal or the data protection officer involved in defining the scope and assessing the transfers. IT can trace systems and verify settings, but deciding the legal basis and what safeguards are needed shouldn't land on one administrator.
Also, GDPR does not generally require all personal data to stay in the EU. Transfers outside the EU can be permitted under applicable rules and safeguards. Have legal assess each flow rather than assuming a US location automatically means it must be replaced.
Reply to this answer
Treat this as a staffed project, not a spare afternoon task. You'll need input from HR, procurement and the people who own each service, along with IT and legal. If nobody has capacity to coordinate it, get management to assign an owner or consider outside help.
Reply to this answer
Don't limit the inventory to obvious customer databases. Payroll, website analytics, credential tools and support services can all be worth checking for personal data and vendor access. Start with the systems that handle the most sensitive data or have the least clear flows, then work through the rest.
Reply to this answer
Add your answer
Answers are reviewed before publication.
mossy+toolkit_4:
Would you put integrations in separate rows?
q73+hinge_408:
Yes, especially if an integration sends data to a different provider or location. Link it back to the systems on either end so the flow is easy to follow.