Data Map - Do we need to publish?

[crc-ict]

We are having some debate here amongst those of us working on GDPR.

 

Does anyone know (@GrumbleDook perhaps?), do we need to publish our data map on the school website?

 

We have been advised that we do, but aren't seeing any requirement to do so elsewhere.

 

Thanks

Chris.

[mthomas08]

No you don't need to.

[rom1984]

You need to be able to show transparency about what the school does with a persons data but this doesn't necessarily mean that you would need to publish your data map.

 

I wonder if the person was talking about the FOI Act? If the data map forms part of any of your polices or procedures (for example if it is referred to) then you should pro-actively make this information available to the public. It could be redacted in parts if you felt there are parts of it that could jeopardise the security of your infrastructure.

Edited March 16, 2018 by rom1984

[enjay]

You might want to include an edited version in your Privacy Policy, listing what you share and with whom, possibly retention periods too. I don't think that is required though, but it does show transparency, shows you're taking data protection seriously and might head off a few questions as people ask what you hold about them.