Data flow mapping records where personal data moves — from collection through processing to storage and eventual deletion. Folelse links your ROPA entries to assets (where data lives) and suppliers (who processes it on your behalf).
Linking a supplier / processor to a ROPA entry
1Open the ROPA entry.
2Scroll to the Third-Party Sharing section.
3Click Add Recipient and search for the company (must already exist in Dashboard → Companies).
4Set the relationship: Processor (they act on your instructions), Joint Controller (you make decisions together), or Recipient (you share data with them for their own purposes).
5Confirm whether a DPA (Data Processing Agreement) is in place — Folelse will flag if one is missing.
6Save the entry.
International transfers
If any recipient or asset is located outside the UK (including within the EEA, which no longer has automatic UK adequacy for all purposes), you must record the transfer and its lawful basis.
Adequacy decision — the country has been recognised as providing adequate protection (e.g. EEA countries, Japan).
UK International Data Transfer Agreement (UK IDTA) — the new UK equivalent of EU Standard Contractual Clauses.
Binding Corporate Rules (BCRs) — for multinational organisations.
Explicit consent — the individual has consented knowing the risks.
Transfers to the United States must use a UK IDTA or the UK Extension to the EU-US Data Privacy Framework. A simple DPA is not sufficient on its own for US transfers.
Viewing your data flow map
Go to Dashboard → ROPA and click the "Data Flow Map" tab to see a visual diagram of how data moves across your organisation, with colour-coded lines showing transfer types and risk levels.
