Task 2 — Data, Data Subjects & Data Flows

Task 2 — Data Categories, Data Subjects & Data Flows

Which data, about whom, from where, to whom — and in which system?

For each processing activity, describe the data and how it flows. This is where data minimisation happens: every data category has to be needed for the purpose.

What to document

Data categories: e.g. contact data, bank details, health data — and whether sensitive data is involved
Data subjects: employees, applicants, customers, suppliers' contacts, website visitors
Sources: collected from the person, or obtained from third parties
Recipients: internal departments and external parties, e.g. tax office, payroll provider
Systems: the applications and storage locations where the data lives
Minimise: question every category — is it really needed? Remove what is not.

Example: processing activity "Payroll"

Data categories	Name, address, tax and social security number, bank details, salary, sick days
Sensitive data	Sick days (health) — only the number of days, no diagnosis
Data subjects	Employees, former employees
Sources	Employee, time recording, HR
Recipients	Payroll provider, bank, tax and social security authorities
Systems	Payroll software, HR file share

Minimisation found: the payroll export also contained private phone numbers and emergency contacts — not needed for payroll, so they are removed from the export.