CCPA/CPRA Data Mapping: The Why, What, and How

How often does the word “right” show up in the text of the CCPA/CPRA? 

Over 100 times. 

Out of all those references to rights, it doesn’t seem that the rights of businesses are often discussed. In the CPRA, consumers get all the rights, while the word businesses are most associated with is “responsibility.” 

Businesses that are subject to the CPRA have responsibilities to their consumers—responsibilities to manage the proliferation of personal data across their organization, responsibilities to respond to consumer requests, responsibilities to protect consumer data, and more. 

The only way to attend to those responsibilities is to know where you collect personal data, where you process it, where it’s sent, whether or not it’s adequately protected, and whether or not it's being treated compliantly. 

In essence, if your business is subject to the CPRA, then it is imperative that you map your data and data processing activities. We’ll explain why and how in this article. 

CCPA/CPRA Data Mapping Requirements 

Like most data privacy regulations, the CPRA does not directly require you to map your organization’s data. However, if you knowingly refuse to map where, how, and why your organization processes personal information, then any violations that take place associated with unmapped (and therefore unknown) personal information under your control could be construed as negligence. 

If you don’t map your organization’s personal data processing activities, how will you: 

• Respond to consumers’ subject rights request for a summary of their personal information under your control?  
• Delete a consumer’s personal information upon request? 
• Know which service providers, third parties, and contractors are handling personal information, and therefore which contracts require data processing addenda? 
• Ensure that you’re processing the minimum amount of data necessary—and are therefore taking on the minimum amount of risk? 

Moreover, the CPRA not only requires you to manage the personal information you collect, but it also creates the concept of sensitive personal information.  

Sensitive personal information includes data with the potential to cause harm to the associated consumer if it should be left unprotected, such as their medical information, social security number, sexual identity, and more. In order to apply the higher level of protection required by the CPRA to this information, you’ll need to engage in sensitive data discovery to identify where it lives and flows in your organization. 

The “How-To” of CPRA Data Mapping 

How do you actually approach mapping your organization’s data in the context of the CPRA? There are a few different strategies, each of which will suit different kinds of organizations. 

Manual Mapping With Spreadsheets 

For very small organizations or organizations who know they have only a handful of essential systems to map, the manual approach can work. 

Under this approach, you’ll develop spreadsheets that log all relevant compliance information associated with a given store of personal information, such as who owns or controls the systems, where the data is sourced from, where it is sent to, and so on. 

Once your spreadsheet library is complete, you can simply contact the system owner to carry out any requisite tasks, such as fulfilling DSARs and auditing contracts for data processing addenda.  

It doesn’t take much to see the flaws in this approach, however; if you have any more than a handful of systems that process personal data, then the task of creating and maintaining a spreadsheet-based data map quickly becomes untenable. In fact, the average company uses 130 different SaaS applications—many, if not most, of those systems will be handling consumer data in some fashion.  

That’s treating each system as equal, too. In reality, some systems will contain more or less personal information, sensitive personal information, subsystems, connected vendors, and so on. 

Homegrown, Data Science-Driven Approaches 

Some organizations may have data science resources in place, whether that’s a team of experts, a homegrown solution, or an off-the-shelf business intelligence tool. These businesses are in a better position to map their organization’s data for CPRA compliance than those relying on the manual approach—but there are still issues to overcome. 

For one, multipurpose data science resources will be in high demand. After all, data science falls under the broader umbrella of business intelligence—compliance isn’t typically thought of as a business intelligence activity. Although a data science asset will technically be faster at CPRA data mapping than a manual approach, you may have to wait a long time before it’s “your turn.” 

Then, there is also the likelihood that a homegrown approach to CPRA data mapping will still require a great deal of manual effort. Data science experts aren’t data privacy and compliance experts after all; they’re data science experts. A privacy professional will need to review the output and fill in the metadata necessary to make your data map actionable from a compliance perspective. 

Dedicated Privacy Approaches 

Given how essential data mapping is to an effective privacy program, there are data mapping solutions designed specifically for data privacy and compliance professionals. Osano Data Mapping is one such example. 

Rather than rely on manual discovery or require data science expertise, Osano Data Mapping quickly uncovers systems that contain personal information by integrating with your Single Sign On (SSO) provider. 

Based on criteria like the number and types of data fields, vendor flows, and identities managed, Osano Data Mapping assigns systems a risk score that enables privacy professionals to prioritize by risk and effort. Any systems that live outside of your SSO can be easily mapped using an automated workflow that keeps external stakeholders alert to any outstanding tasks.  

The benefit of using a privacy-focused solution like Osano for CPRA data mapping is twofold:  

1. It’s far easier and faster to use for privacy purposes (rather than general business intelligence purposes). 
2. It surfaces mapped data for use in downstream compliance activities. The rest of the Osano Platform can use discovered systems and data in its DSAR, privacy assessment, RoPA, and other support capabilities, making the rest of a privacy professional’s job easier, too. 

If you’re looking for a privacy-focused approach to CPRA data mapping, consider scheduling a demo of Osano today.