A privacy impact assessment depends on a clear inventory and mapping of personal data and its processing flows. Documenting information flows and maintaining a repository of collected personal data establishes the factual basis for identifying privacy risks throughout the data lifecycle. The ICO’s DPIA guidance specifically calls for clear presentation of personal-data flows among people, systems, and organisations.
Community Discussion