VS FAQs
- vsRisk Cloud
- vsRisk Manuals
- vsRisk Videos
- Compliance Manager
- Data Flow Mapping Tool
- Training Webinar
- Latest CyberComply updates
- Latest Data Flow Mapping Tool updates
- Webinar assets
- Support and Update Package

Data Flow Mapping Tool

Getting started
Creating a process
Getting help
Renewing and upgrading

Getting started

What is the Data Flow Mapping Tool?
The Data Flow Mapping Tool is for organisations of all sizes that need to identify the personal data they process and bring their practices in line with the General Data Protection Regulation (GDPR). The tool makes it easy to create data flow maps that can be reviewed, revised and updated when needed. It will help you get a thorough understanding of what personal data your organisation processes and why, where it is held and how it is transferred.

What happens after I purchase the Data Flow Mapping Tool?
You will receive an automated response email with login instructions for CyberComply, the online platform that hosts the Data Flow Mapping Tool. Once you have followed the login instructions, you will be able to begin mapping the flow of personal data through your business processes.

What is CyberComply?
CyberComply is an online cyber security and compliance platform. It is developed by Vigilant Software and hosts a number of integrated tools, including Compliance Manager and the Data Flow Mapping Tool.

How do I use the Data Flow Mapping Tool?
When you log in to CyberComply you can navigate to the Data Flow Mapping Tool by clicking the button on the homepage (also referred to as the dashboard). This will direct you to an area where you can set up the business processes you want to map.

Creating a process

How do I create a process?
First, you need to switch to edit mode. To do this, click on the spanner icon towards the right of the menu bar that runs along the top of the window. Then, click the toggle next to ‘Edit mode’.

A ‘Create process’ button will appear in the left-hand panel. Click on it and enter details about your process in the pop-up window. Then click ‘Save’.

What is the ‘Acting as’ field for?
The ‘Acting as’ field for a process allows you to state whether your organisation is a data controller, data processor or third party with respect to processing.

Who should I designate as the process owner?
The process owner should be the individual or role responsible for running that particular process.

How do I define the scope of a process?
Processing is any operation or any set of operations performed on personal data, such as adapting, aligning, altering, collecting, combining, destroying, disclosing, disseminating, erasing, organising, recording, restricting, storing or structuring. When you define the scope of a process, summarise the sequence of activities that are used to collect, manipulate and output personal data.

What are the purpose(s) of a process?
The purpose(s) of processing is/are the specified reason(s) for processing personal data within the given scope of a particular process. A data flow map of a process should chart the entire journey of personal data as it is processed for the purposes specified. If the same data is processed for an additional set of purposes, this constitutes a different process and should be mapped separately.

Creating a map
Do I need to be in edit mode to work on a map?

No. Edit mode is solely for creating processes and editing top-level information about existing processes. You can start a new map or edit a map without being in edit mode.

How do I open the mapping area?
Select the process you want from the left-hand panel. This will make it appear in the central panel. Click the ‘Data flow map’ button to open the mapping area.

What should be on my data flow map?
Your data flow map should contain all the supporting assets used to process personal data. For every asset you can specify the asset type, name, location, whether it is operated by the data controller, data processor or a third party, and whether there are any records stored on the asset. You can add data transfers between assets that show which data items pass from asset to asset and what method is used for each transfer.

How do I create an asset?
To create a new asset, click on the plus icon on the left-hand panel. Then select the type of asset you want to add. When you click on the asset, it will appear on your map.

How do I create a transfer?
To create a transfer, you need to have added at least two assets to your map. Click on the transfer tool from the toolbar (the icon shows a line connecting two dots), then hover your cursor over the asset from where the transfer starts. An orange dot will appear. Click to fix it as the start of the transfer and then hover your cursor over the asset at the end of the transfer. Again, an orange dot will appear. Click to fix it as the end point of the transfer.

How do I show where personal data enters the process?
To show where personal data enters the process, you need to add an input point. To do this, simply click on the input icon from the toolbar. A grey dot will appear on your map. You can move this around your map in the same way that you move assets and you can use the transfer tool to mark the transfer or personal data into the process from that point.

How do I add information about assets and transfers?
To add information about your assets and transfers, simply click on the hand tool from the toolbar (to make sure you are in the right mode) and then click on the asset or transfer you want to add information to. This will open the attributes panel to the right of the screen. This panel contains a number of fields that you should complete. You can also add comments to assets and transfers to record additional information or raise queries.

How do I add data items?
To add data items to your map, you first need to add an input point to show where personal data enters the process. Once you have done so, create a transfer between that point and the first asset that is used to process the personal data. Then click on the hand tool and select that transfer. This will open the attributes panel to the right of the screen. Here, you can click on ‘Data items’ to expand the data items section and select the categories of data subject, the types of data item and the lawful basis for processing.

Why can’t I add data items to all transfers?
You can add personal data to transfers from an input point (the places where personal data enters the process). For all other transfers, you can select from a list of existing data items which ones are being transferred at that point.

Why are the assets different colours?
The assets you create will have a set colour depending on whether they are operated by the data controller, data processor or a third party. By default, any new assets you create will draw information about its operator from the process ‘Acting as’ field. For example, if you create a new process in which your organisation is the data controller, all new assets you create for that process will, by default, show as being operated by the data controller. You can override this default by selecting the asset and choosing an alternative option in the attributes panel.

How do I show data returning to the data subject?
If your process involves sending personal data back to the data subject(s), you can add an appropriate asset to the map (e.g. email or post) and change the asset reference (the text that will appear as the asset label) to make it clear that the asset belongs to the data subject.

How do I move an asset?
To move an asset, click on the crossed-arrow tool from the toolbar. Then click on the asset you want to move and drag it about the screen.

How do I navigate about the map?
To navigate about the map, click on the hand tool from the toolbar. Then click an empty point on the map and drag to move to a different area.

Can I print out the map?
Yes. The Data Flow Mapping Tool can generate a full process report, including an image of your map, an asset register and a personal data inventory. To access it, simply open the map for the process you need and click the ‘Print’ icon to preview and print the report, or the ‘Export’ icon to export it to another format.

Getting help

Is there a user guide?
Yes. To access the user guide, open any map within your account and click the help icon. The user guide also includes a glossary and various help articles. If you would like a PDF copy of the user guide, please click here to download.

Is there any training/support available?
Our service centre provides technical support. If you are looking for expert advice on data flow mapping and the requirements of the GDPR, you can also purchase consultancy support, which is available in a variety of formats.

Can I get consultancy support?
Yes. You can purchase Live Online consultancy by the hour or contact the service centre to discuss your consultancy needs.

Renewing and upgrading

I purchased the Data Flow Mapping Tool last year but can’t access my account. Why?
Licences for the Data Flow Mapping Tool expire after one calendar year. To renew your licence, please visit our webshop or contact the service centre for more advice.

I’ve bought the Data Flow Mapping Tool but would like to upgrade to the joint package with Compliance Manager. How do I do this?
Simply purchase a Compliance Manager package from the Vigilant Software webshop or contact the service centre for more advice.

If I have the Data Flow Mapping Tool and it’s time to renew, can I switch to the joint package with Compliance Manager?
Yes. You simply need to purchase the appropriate package from the Vigilant Software webshop.