Why use Data Management
Data Management helps you keep track of which personal information an asset processes and how that data is handled. It ensures you meet GDPR requirements, gives a clear overview of data flows, and documents how data is stored, deleted, or exported.
This reduces the risk of missing obligations and makes audits or internal reviews easier, as you always know what data is collected and who it relates to.
Hint: If an asset is linked to a Data Processing Activity in the GDPR module, the asset is automatically relevant for GDPR and Data Management is enabled.
Managing Personal Information
In this section, you can register which types of personal information the asset processes and who the information relates to. You can register this information by clicking on + Create new, and then you can select:
Category of people: Select the group of individuals whose personal data is stored in the asset, such as employees, applicants, or other relevant categories.
Information types: Choose the specific personal information processed in the asset. You can select from normal personal information (name, email, phone, etc.), confidential information (such as salary), criminal conditions, and sensitive personal information (health data, biometric data, political affiliation, etc.).
Custom labels: If the required category of people or information type is not listed, you can create a custom label for each of them.
Once you have selected the category of people and information types, the data is shown in the overview so you can easily see what personal data the asset contains.
Managing Deletion of Data
In this section, you can add information about how data stored in the asset can be removed, exported, and how long it is kept:
Deletion: Specify whether it is possible to delete data in the asset.
How deletion happens: Select how data can be deleted, for example manually by a user, automatically after a retention period, or through an API/service request.
Data retention: Enter how long data is stored before it is deleted, and choose the correct time unit (days, months, years, etc.).
Export: Select whether it is possible to export the stored data in a commonly used format before deletion.
Deletion procedure: Describe how the deletion process works in practice, including who can request deletion, how it is carried out, and whether there are any approval or logging steps.
