[Note: to choose a different table layout, click in the table, select the Design menu ribbon and choose

a table
style]

Personal Data Flow Mapping Security Classification: [Insert Classification]

Business Area Covered: [Business Area]
Completed By: [Name]
Date: dd/mm/yy

The following personal data flows occur within the business area under consideration.

Ref Personal Data Item(s) Inflow/Outflow or Both Volume of records Internal or external Source / Destination Transfer Method Controls Applied Comments
1 Customer information - name, Both 500 per day External Courier Electronic via interface Encryption at rest Customer information is printed on delivery
address, DoB, credit card data Encryption in transit note and on address label
2 HR/Employee data, including Outflow Approx. 2000 each month External HR service provider (EU- Downloaded onto DVD and sent Data is encrypted prior to burning This will be replaced with a file transfer soon
social security number and next based) via courier onto DVD
of kin

07/09/2019 Page 1 of 2 Confidential

 Personal Data Flow Mapping - Completion Instructions
The intention of this spreadsheet is to document the inbound and outbounds flows of personal data within the
organization.

The intended meanings of the listed columns are as follows.

Column Meaning
Ref A sequential reference number starting with 1
Personal Data Item(s) A description of the personal data involved; this may be a
type of form or document or specific data related to a type of
transaction e.g. a sale or order
Inflow/Outflow or Both Is the data going out to somewhere else, coming in to the
business area, or both?
Volume of records Approximately how many data records are transferred on
each occasion?
Internal or external Is the destination within the organization or to an external
third party?
Source / Destination Where does the data come from, or go to? This may be an
internal business area, the name of a third party
organization or, if applicable, a country
Transfer Method How is the transfer achieved e.g. electronically, via courier,
hand, telephone, fax, email, post, text message
Controls Applied describe the security controls that are applied to the transfer
e.g. is the data encrypted, is it signed for, is the destination
verified before despatch
Comments Any other comments you would like to make about the
transfer

07/09/2019 Page 2 of 2 Confidential