Actors and data assets
Manage the directory of people and organizations involved in your processing activities, as well as the inventory of your systems and applications.
Actor directory
The directory groups all people and organizations involved in your data processing: your own organization, sub-processors, SaaS vendors, business partners, and internal individuals (DPO, business owners). Each actor has a profile with contact details, their role in your processing activities, and associated contracts. When you create a processing activity, you select the relevant actors directly from the directory.
Data assets
The data asset inventory lists your systems, applications, and databases that process personal information: your CRM, payroll system, analytics tools, website, etc. For each asset, you document the type (SaaS, on-premise, cloud), the operator, the hosting country, the security measures applied, and certifications held (SOC 2, ISO 27001, etc.).
Linking actors, assets, and processing activities
Actors and assets are linked to your processing activities in the registry. When you document a "Payroll Management" activity, for example, you associate the actor (your payroll vendor), the asset (the payroll software), and the data processed. This linkage creates a traceability network: if a sub-processor changes, you immediately see which processing activities are affected.
Sub-processors and processor chains
Conformaze allows you to model sub-processing chains. A primary vendor (e.g., your CRM) may itself rely on sub-processors (hosting, analytics, support). You document each link in the chain, with the processing country and the associated DPA contract. Transfers outside Quebec are automatically detected and flagged for assessment.
Data flow mapping
From Tools & Reference > Actors directory > Data Map, visualize personal information flows between your organization, your sub-processors, and the individuals concerned (employees, customers, prospects). Each arc on the map represents a type of flow; the color indicates its criticality: blue for a standard flow, orange for an out-of-Quebec transfer, red for sensitive personal information (health data, financial information, biometric data). This view is directly usable during a PIA: it allows you to quickly identify high-risk flows and link them to the relevant processing activities. Filter by actor type or criticality level for a focused analysis.
Data flow mapping