Table of Contents
LGPD and Data Mapping
It is still common to find companies saying that they are complying with the General Data Protection Law simply by acquiring privacy platforms, through which they do the data mappingThe development of policies indicates the legal basis for treatment and other measures. It's that simple, as if filling out a form, however lengthy, guaranteed... conformity legality and compliance with the fundamental rights and guarantees of personal data protection holders.
Who does the data mapping?
O data mappingData inventory, or inventory management, can be carried out by consulting firms or by internal teams within the organization. When internal teams perform this task, it often falls to the IT department. Other times, it's the legal team that does it.
Reading the book by philosopher Mario Sergio Cortella, Why do we do what we do?I understood that everything I had done before in my professional life had led me to that meeting, in which the CEO The company asked me: Do you understand now why you were called to this meeting?
In March 2019, I was coordinating a team of analysts who were mapping and automating business processes, according to management principles. Business Process Management (BPMAn IT coordinator had convened a committee to discuss Law 13.709/2018, published a few months earlier and scheduled to come into effect soon. According to him, it was a law concerning the processing of personal data, and adjustments to our logical environment would be necessary to ensure compliance with the legislation – starting with data mapping, which is precisely the... expertise from the Processes team.
Thus began a fantastic journey for the process analyst team. In the following months, we defined the action plan based on project management requirements, selected the sample to be inventoried, clarified the board From the company, we selected the leaders who would support us, we defined the checklists From the interviews, we interviewed hundreds of employees and mapped out the flows of personal data.
Obviously, while all this was happening, we studied the LGPD (Brazilian General Data Protection Law) to understand what we were doing, explained the reasons behind it to the interviewed employees and others involved, reviewed processes, adjusted what was urgent to the LGPD, adapted contracts, analyzed end-to-end processes, gained even better knowledge of the organization, identified bottlenecks in processes and security vulnerabilities that were corrected immediately, and thus, we were acculturating the organization and strengthening an ecosystem of personal data protection that already existed.
And then? Oh, yes! We hired a consulting firm to do the... assessmentWe acquired a privacy platform, trained employees, and everything else.
At the end of this journey, we realize that the decision to place the data mapping Putting the process team in charge was the right decision. Those who map processes see and understand where a corporation's personal data flows, gaining a comprehensive view of the business architecture.
Believe me, it's no use skipping steps and applying a form thinking you'll comply with a complex and cross-cutting law like the LGPD (Brazilian General Data Protection Law). Call in professionals who understand where personal data processing takes place: in business processes.
Did you enjoy the article? Read another text by the same author about... 1st ANPD Meeting of Data Protection Officers.
