On March 18, 2024, the Bermuda Office of the Privacy Commissioner (PrivCom) published a blog on data mapping and data flows. In particular, the blog distinguishes between data mapping and data flows and discusses different types of data mapping methods.

What is data mapping and what are data flows?

The blog describes data mapping as the creation of a roadmap to locate information stored within an organization's various storage mediums, including hardware, software, and physical files. For effective management, the blog emphasizes the importance of understanding the whereabouts and processes of data not only in isolated business units but across the whole organization.

Data flows are defined in the blog as the tracking of information movement through different processes or systems within an organization. According to the blog, understanding data flows is critical for seeing how data is moved, transformed, or updated, ensuring efficient and accurate management across systems.

Data mapping methods

The blog outlines several data mapping methods, including:

• manual data mapping, involving manual coding of data source and destination links;
• semi-automated data mapping, involving a blend of manual and automated mapping;
• automated data mapping, which utilizes drag-and-drop tools for mapping larger datasets without manual coding; and
• schema mapping, which uses a semi-automated method using software to link similar schemas with minimal manual effort.

When employing data mapping tools, the blog notes that it is important to consider privacy risks, especially regarding metadata management, whether stored on-site or in the cloud, and the use of proprietary or open-source tools. To safeguard privacy, the blog advises organizations to evaluate who has access to metadata.

You can read the blog here.