Data Classification, Inventory, and Data Mapping
What this domain tests
You are tested on finding personal data, labelling it, and proving where it flows. Expect questions that contrast a record of processing with a data flow map, or that ask which classification tier a dataset attracts and what handling rule follows.
Classification
- Typical tiers run Public, Internal, Confidential, Restricted. The tier is driven by sensitivity, regulatory category (Art 9 special categories, financial, children's data) and contractual obligations, with the strictest driver winning.
- A label is only useful if it changes behaviour: storage location, encryption requirement, sharing approval, DLP policy, retention period and access approval must all be defined per tier.
- Classify at field level where possible. A customer record may mix Public, Internal and Restricted fields; classifying the whole system as one tier loses the control.
- Automated discovery and classification tooling helps with unstructured data and shadow IT, but produces false positives that need triage. Data owners approve the label; stewards maintain it; custodians run the controls.
Inventory and mapping
- The Art 30 record of processing states purposes, categories of data subjects and data, recipients, third-country transfers, retention and security measures. Controller and processor versions differ; a processor's record references the controller.
- A data flow map is different: source, collection point, processing steps, storage systems, sharing and transfer recipients, jurisdictions and deletion. Include interfaces and vendors, not just internal systems.
- Link inventory to classification and to retention schedules, and maintain lineage so you can answer where a single data element lives.
- Maps go stale quickly. Review on change events: new vendor, new system, new jurisdiction, new product feature.
Worked example
HR launches a wellness app for employees. Data subjects are employees; the data includes health information, so it is an Art 9 special category and lands in Restricted. The Art 35(3)(b) trigger (large-scale special-category processing) makes a DPIA mandatory. Mapping shows a US-hosted vendor, so a transfer mechanism and transfer impact assessment are needed. The RoPA entry records purpose, categories, recipient, retention and security measures. Reasoning: classify the data element first, then derive the obligations.
Traps that cost marks
Treating the RoPA as a complete data map; classifying by system rather than by data element; ignoring spreadsheets and departmental SaaS; calling pseudonymised data anonymous; leaving maps unreviewed after architecture change.