Mapping data flows and third-party sharing

Data flow mapping records where personal data moves — from collection through processing to storage and eventual deletion. Folelse links your ROPA entries to assets (where data lives) and suppliers (who processes it on your behalf).

Linking a supplier / processor to a ROPA entry

1. 1 Open the ROPA entry.
2. 2 Scroll to the Third-Party Sharing section.
3. 3 Click Add Recipient and search for the company (must already exist in Dashboard → Companies).
4. 4 Set the relationship: Processor (they act on your instructions), Joint Controller (you make decisions together), or Recipient (you share data with them for their own purposes).
5. 5 Confirm whether a DPA (Data Processing Agreement) is in place — Folelse will flag if one is missing.
6. 6 Save the entry.

International transfers

If any recipient or asset is located outside the UK (including within the EEA, which no longer has automatic UK adequacy for all purposes), you must record the transfer and its lawful basis.

• Adequacy decision — the country has been recognised as providing adequate protection (e.g. EEA countries, Japan).
• UK International Data Transfer Agreement (UK IDTA) — the new UK equivalent of EU Standard Contractual Clauses.
• Binding Corporate Rules (BCRs) — for multinational organisations.
• Explicit consent — the individual has consented knowing the risks.

Viewing your data flow map

Go to Dashboard → ROPA and click the "Data Flow Map" tab to see a visual diagram of how data moves across your organisation, with colour-coded lines showing transfer types and risk levels.