risk
Undocumented data inventory and unmapped data flows
No authoritative record of what personal data is held, where, who accesses it, and how it flows to processors/sub-processors and across borders — preventing risk assessment, DSR fulfilment, and enforcement of privacy obligations.
In catalog since 2026-09-17T22:28:00Z · Last changed 2026-09-17T22:28:00Z (f368a6cce277)
Record JSON · Open in map · Data retrieval guide
Catalog revision: 791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4. A connection does not establish full coverage.
Attributes
- category
- privacy
- domain
- Data Protection & Privacy
- Asset Management & Inventory
- taxonomy
- nist-privacy-risk
- inherent_rating
- medium
Details
- risk_id
- data-inventory-flows-unmapped
- category
- privacy
- likelihood
- high
- impact
- medium
- inherent_rating
- medium
- treatment
- mitigate
- taxonomies
- nist-privacy-risk
Source
No record-specific source URL is provided.
Connections
- UC-ASSET-05 — Inventory supplier services and assess critical suppliers mitigates Undocumented data inventory and unmapped data flows
- strength
- related
- rationale
- Supplier-service inventory records only the processor/sub-processor leg, a partial contribution; the authoritative data inventory, RoPA, and flow diagrams (UC-02) are the operative defense for this privacy risk.
- UC-DATA-01 — Process personal data only under a documented lawful basis mitigates Undocumented data inventory and unmapped data flows
- strength
- primary
- rationale
- Maintaining and annually reviewing a processing register creates the authoritative record of processing activities and purposes the risk says is missing.
- UC-DATA-14 — Maintain and provide an accounting of disclosures mitigates Undocumented data inventory and unmapped data flows
- strength
- related
- rationale
- Recording every disclosure's recipient, categories, and purpose builds a partial authoritative record of outbound data flows.
- UC-ASSET-02 — Inventory data and document processing activities and flows mitigates Undocumented data inventory and unmapped data flows
- strength
- primary
- rationale
- Maintaining data inventories, RoPA, and data-flow diagrams directly produces the authoritative data-flow record this risk says is absent.