Privacy data map

The data map at /privacy/data-map is the technical inventory behind the RoPA and privacy review workflows. It shows systems, datasets, processing activities/purposes, and the relationships between them. Search by system, dataset, or purpose and filter for sensitive data, sale/sharing, and transfer signals.

Where the map comes from

Noru consumes a Fideslang-shaped manifest containing systems, datasets/collections/fields, and privacy declarations. Sources can arrive through CI/API/MCP workflows and through supported connectors. Connector composition currently uses workforce/identity signals and HaileyHR schema evidence to build one stable connector-derived source, avoiding duplicate activities from separate HR and identity connectors.

When an in-scope workforce exists, Noru can seed a standard workforce-processing skeleton. It is explicitly an asserted starting point, not proof of every processing operation. Purpose narrative, lawful basis, retention, and transfers are left for human review.

What ingestion does

1. Upsert the source and calculate a deterministic checksum.
2. If the manifest is unchanged, refresh receipt/evidence timing without creating a new version.
3. Parse and validate category, use, and subject keys against the taxonomy; retain warnings.
4. Diff against the previous version and write an immutable source version.
5. Materialize systems, datasets, and activities; items missing from the new version are soft-archived.
6. Mirror the source as audit evidence for relevant data-map/RoPA controls.
7. Schedule best-effort enrichment and assessments for new sensitive or cross-border processing.

Because a connector-composed source has a single writer, every refresh includes all current connector contributions. An empty connector pass is skipped rather than interpreted as “all processing disappeared.”

Reading the graph

• System nodes represent applications or services performing processing.
• Dataset nodes represent structured collections and their categories/fields.
• Activity nodes represent purposes/data uses with subjects, categories, and privacy attributes.
• Edges show declared references and processing relationships, not observed network traffic.

Open source/version details to understand branch, commit, checksum, change summary, warnings, and what was added, modified, or removed. Use this provenance when deciding whether a RoPA change is real.

Manual activities

Users can create a processing activity where no technical source describes it. Set the system, purpose, data use, categories, subjects, and relevant flags. Manual records are useful for offline and business processes, but should name a real owner and evidence source so they do not become untestable declarations.

Limits

• The map describes declared or connector-emitted facts; it is not packet-level discovery.
• A field existing in an HR schema does not mean every employee has a value or that Noru reads the value.
• Taxonomy warnings need review; unknown keys can weaken downstream classification.
• Source removal can archive materialized records, so inspect the change summary before accepting drift.