gdpr-data-mapping
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseGDPR Data Mapping
GDPR 数据映射
Create the records and workflows that demonstrate GDPR compliance.
创建用于证明 GDPR 合规性的记录和工作流。
1. Data Inventory (Article 30 Records of Processing)
1. 数据清单（Article 30 处理活动记录）
For each processing activity capture:
- Purpose and lawful basis (consent, contract, legal obligation, vital interests, public task, legitimate interests — with the LI balancing test documented)
- Categories of data subjects and personal data (special categories flagged: health, biometrics, political, etc.)
- Recipients including subprocessors and international transfers
- Retention periods with the justification for each
- Security measures (technical and organizational)
为每项处理活动记录：
- 处理目的和合法性基础（同意、合同、法律义务、重大利益、公共任务、正当利益——同时记录正当利益（LI）平衡测试）
- 数据主体类别和个人数据（标记特殊类别数据：健康数据、生物识别数据、政治观点等）
- 接收方，包括子处理者和国际传输
- 保存期限及其理由
- 安全措施（技术和组织措施）
2. Data Flow Mapping
2. 数据流映射
- Systems inventory cross-referenced: which system holds which data fields, where backups and logs replicate them
- Marketing/CRM/analytics flows separately — consent state travels with the data
- Third-country transfers: identify mechanisms (adequacy decisions, SCCs, EU-US DPF) and conduct transfer impact assessments
- 交叉引用系统清单：明确每个系统保存哪些数据字段，以及这些字段如何复制到备份和日志中
- 单独梳理营销、CRM 和分析平台的数据流，确保同意状态随数据一同流转
- 第三国传输：确定传输机制（充分性决定、SCCs、EU-US DPF），并开展传输影响评估
3. Data Subject Rights Readiness (Articles 15–22)
3. 数据主体权利响应准备（Articles 15–22）
- Verify operational ability to: access, rectify, erase, restrict, port, and object — within one month
- Identity verification without excessive data collection
- Erasure reality check: backups, logs, analytics stores — document what "deletion" means per system
- Consent capture proof: when, how, what was shown (for consent-based processing)
- 验证是否能够在一个月内实际完成以下操作：访问、更正、删除、限制处理、数据可携和反对处理
- 在不过度收集数据的情况下进行身份验证
- 删除可行性核查：检查备份、日志和分析存储，并记录每个系统中“删除”的具体含义
- 同意采集证明：记录同意的时间、方式和展示内容（适用于基于同意的处理活动）
4. Breach Response (Articles 33–34)
4. 数据泄露响应（Articles 33–34）
- 72-hour supervisory authority notification: template ready, decision tree for "risk to rights and freedoms"
- Internal escalation path that reaches the DPO fast (detection → assessment → notify)
- Documentation of every breach decision, including non-notified ones with reasoning
- 准备好向监管机构进行 72 小时通知的模板，以及判断“对权利和自由造成风险”的决策树
- 建立能够快速通知 DPO 的内部升级路径（发现 → 评估 → 通知）
- 记录每次数据泄露事件的所有处置决定，包括未通知监管机构的事件及其理由
5. Accountability Extras
5. 问责补充措施
- DPIA process for high-risk processing (Article 35): criteria, completed DPIAs, residual risk sign-off
- Privacy notices match actual practice (Article 13/14)
- Processor contracts include Article 28 clauses
- 为高风险处理活动建立 DPIA 流程（Article 35）：制定评估标准、完成 DPIA，并对剩余风险进行签核
- 确保隐私声明与实际处理情况一致（Articles 13/14）
- 确保处理者合同包含 Article 28 条款
Output
输出
RoPA spreadsheet/registry, data-flow diagrams, rights-request runbook, breach decision tree, and a gap list prioritized by risk.
RoPA 电子表格或登记库、数据流图、权利请求操作手册、数据泄露决策树，以及按风险优先级排序的差距清单。