Important notice
The Classic Experience will be sunset on
Aug. 1.
If you have questions, contact your Customer Success and Implementation Manager,
Account Manager, or
support@trustarc.com.
A Simple Business Process Record uses the Type 2 Business Process Template — a streamlined record type designed for business processes that require system-level data flow mapping without the full complexity of a Standard record. The Type 2 Template covers the core compliance requirements across eight tabs.
This article walks through all ten steps of creating a Simple Business Process Record, from selecting the template through to finalizing and publishing the record.
What you can do
✓Create a Simple Business Process Record using the Type 2 template
✓Add systems, configure data subjects, recipients, and hosting locations
✓Map incoming and outgoing data flows between systems and data subjects
✓Review auto-populated data elements and processing purposes, and assign legal bases
✓Review risk scores, link assessments, classify with tags, and publish the record
Type 2 Template — Tab structure
•Details — Record name, description, entities, and owning contacts
•Systems Selection — Systems involved, data subjects, recipients, and hosting locations
•Build Data Flow — Mapping of data flows between systems and data subjects
•Purposes & Elements — Data elements, processing purposes, and AI disclosure
•Security & Retention — Retention period and security controls
•Legal Basis — Legal justification for each processing purpose
•Risk & Assessments — Risk scores and linked assessments
•Tags — Classification tags for filtering and reporting
📋 Note: The Type 2
Template does not include the Custom BP Questions tab found in
the Standard (Type 1) template. All changes are saved automatically
as you navigate between tabs.
Prerequisites
✓Active TrustArc account with permissions to create Business Process Records
✓Systems to be included already exist in the System Inventory, or you are prepared to create new ones
✓You know the name, purpose, and relevant data subjects for the business process
The Open FlowChart, Open Map,
Edit Revalidation Date, Comments,
Attachments & Links, Notes, and
Copy Record Link functions are centralised within
the top navigation of the record and are available at any
step.
When comments, notes, or attachments and links are added,
a count indicator becomes visible on the corresponding icon.
To receive an in-app notification when it is time to revalidate,
click
Edit Revalidation Date
and set the
Notification Type
to In-app task.
Click the Activity log icon at any time to see who
made changes to the record and when.
Step 1 — Navigate to Business Processes and create a new record
Business Process Records are managed from the Business Processes module under Data Mapping & Risk Manager.
1
In the left navigation, click the
Data Mapping & Risk Manager
icon, then select
Business Processes.
2
In the top-right corner, click
+ Add New.
A dropdown menu appears with three options:
•New Business Process
— Creates a new record from a template. Use this
option.
•Assign New Business Process
— Assigns an existing process.
•Create New Form
— Creates a custom form.
3
Click
New Business Process.
The Add New Business Process dialog opens.
Step 2 — Select the Type 2 Template
The Add New Business Process dialog lists all available templates, labelled by type (Type 1, Type 2, Type 3) indicating their structure and complexity.
1
Review the list of templates. Use the Search field to filter
if needed.
2
Locate and select
Simple Business Process Template with System Selection or Build Data Flow (Type 2).
A green checkmark confirms the selection.
3
Click Continue.
The new Business Process Record opens on the Details
tab.
📋 Tip: If your business
process does not involve systems, select
Simple Business Process Template without System Selection or Build Data Flow (Type 3)
instead. Type 3 omits the Systems Selection and Build Data Flow
tabs.
Step 3 — Complete the Details tab
The Details tab captures the essential information about the business process — its name, the people whose data is involved, a description, entity access, and the owning contacts.
1
Enter a clear, descriptive name for the business process.
2
Select the
Range of People Involved
from the dropdown if applicable.
3
In the Description field, use the rich text editor
to describe the business process.
4
Under
Select the entities that should have access to this record,
confirm or update the entity selection. Entities shown by
default are pre-configured for your account.
Once the Details tab is complete, click the
Systems Selection tab to proceed.
Step 4 — Complete the Systems Selection tab
The Systems Selection tab identifies the systems involved in this business process and configures data subjects, data recipients, and hosting locations for each.
1
Click the Systems Selection tab.
2
In the left panel, click
+ Add. A dropdown
appears with two options:
•Add System From Inventory
— Select an existing system from your System Inventory.
•Create New System
— Create a new system record directly.
3
Select
Add System From Inventory,
search for the system by name, and select it. The system
appears in the left panel with its name and vendor.
Configure a System
Click on a system in the left panel to configure it. The right panel displays three sub-tabs:
Data Subjects
•Click + Add in the Data Subjects sub-tab.
•Search for and select each data subject. The table shows Data Subject name, Category, and Locations.
Data Recipients
•Click + Add in the Data Recipients sub-tab and select the relevant recipients.
Hosting Locations
•Click + Add in the Hosting Locations sub-tab and select the applicable locations.
Repeat for each additional system involved in the business process. Click the three-dot menu (⋮) next to a system to remove it or access additional options.
📋 Note: The Type 2
template's Systems Selection tab includes Data Subjects,
Data Recipients, and Hosting Locations only — it does not include
Data Elements or Processing Purposes at the system level. These
are managed at the record level in the
Purposes & Elements tab.
Step 5 — Complete the Build Data Flow tab
The Build Data Flow tab maps how data moves between the systems and data subjects configured in the previous tab. It shows both incoming and outgoing data flows for each system.
📋 Notes
•The
left panel lists all systems from Systems Selection. Use
the search field to find a specific system.
•Flowchart View
displays the data flow as a process diagram.
Map View displays
it geographically.
•Configurations
made in Systems Selection persist to the Sends Data To
and Receives Data From tabs.
•If
a system was not configured in Systems Selection, configurations
from the data inventory persist instead.
5.1 Configure the Data Flow for Each System
Click a system in the left panel. The right panel shows two tabs:
Sends Data to [System]
Configure what data subjects and systems send data into the selected system.
•Click the Sends Data to [System] tab.
•Under Data Subjects, click + Add to add data subjects that send data into this system. The table shows: Data Subject, Category, Location, and Sale of Data toggle.
•Enable the Sale of Data toggle for any data subject whose data is sold, if applicable.
•Under Systems, click Add to add other systems that send information to this system.
Receives Data From [System]
Configure what data subjects and systems receive data from the selected system.
•Click the Receives Data From [System] tab.
•Click + Add under Data Recipients to add recipients that receive data from this system. Enable the Sale of Data toggle if applicable.
•Click + Add under Systems to add other systems that receive data from this system.
5.2 Configure Hosting Locations and Notes
•At the top of the right panel, click Configure Locations next to Hosting Locations to specify where the selected system's data is hosted.
•In the Notes field, enter any relevant notes about this system's role in the data flow.
5.3 Preview the Data Flow
In the left panel, click Flowchart View to see a visual diagram of how data flows between all configured systems and data subjects.
Click Map View to see the data flow displayed geographically by hosting location.
Step 6 — Complete the Purposes & Elements tab
The Purposes & Elements tab is automatically populated with data elements and processing purposes from the systems added in the Build Data Flow tab. Review and remove any that do not apply, and add any that are missing.
6.1 Review and Manage Data Elements
•The Data Elements section displays elements automatically pulled from your configured systems. Review the list.
•To remove an element that does not apply, click the delete icon (🗑) in its row, or use Bulk Delete to remove multiple entries.
•To add a missing data element, click + Add, search for it by name, and select it.
6.2 Review and Manage Processing Purposes
•In the Processing Purposes section, review the automatically populated list.
•Remove any purposes that do not apply. Add missing purposes using + Add.
6.3 Disclose Artificial Intelligence Usage
Under the Artificial Intelligence section, select the option that applies:
•Yes, AI is utilized to process data in this record
•No, AI is not utilized to process data in this record
•It's unknown if AI is utilized to process data in this record
Enter any additional context in the Notes field below.
Step 7 — Complete the Security & Retention tab
The Security & Retention tab documents the data retention schedule and the security controls in place for this business process.
7.1 Set the Retention Period
•In the Time Period field, enter the numeric value (e.g., 3).
•Select the Time Interval from the dropdown (e.g., Years, Months, Days).
•If the required interval is not listed, enter it in the Custom Time Interval field.
•Click Clear to reset the fields if needed.
7.2 Select Security Controls
•Click the Select Security Controls dropdown. A searchable list of controls appears.
•Check each control that is genuinely in place for this business process. Selected controls appear as tag chips in the field.
•Click outside the dropdown to close it. Selections are saved automatically.
📋 Tip: Select only
controls that are genuinely in place. Overstating controls can
create compliance risk if the record is reviewed during an audit.
Step 8 — Complete the Legal Basis tab
The Legal Basis tab assigns the legal justification for each processing purpose in the record. The table is automatically populated from processing purposes added in the Purposes & Elements tab.
•The table displays three columns: Category, Processing Purpose, and Legal Basis. Each row represents one processing purpose.
•For each row, click the Legal Basis dropdown and select the appropriate basis. Available options include: Consent, Contract, Legal obligation, Legitimate interests, Public interest, Vital interests, and others.
•Use the search field within the dropdown to quickly find a specific basis.
•Use the pagination controls at the bottom to navigate pages if there are more than five purposes.
📋 Tip: The legal basis
you select should reflect your organisation's actual justification
for the processing activity. Consult your Data Protection Officer
or legal team if you are unsure which basis applies.
Step 9 — Complete the Risk & Assessments tab
The Risk & Assessments tab provides a three-step risk workflow for each risk category and lets you link formal assessments (such as DPIAs) to this business process record.
9.1 Review Risk Scores
Three risk categories are displayed, each with a three-step workflow: Review Risk Score → Complete Risk Assessment → Review Residual Risk Score & Download Report.
Data Processing Risk
•Review Step 1: Review Inherent Risk Score. Status shows Incomplete until the record has sufficient data.
•Click Review Score to open the risk score details.
•Once Step 1 is complete, click Start Assessment in Step 2 to launch a risk assessment.
•After the assessment is approved, click Download Risk Report in Step 3.
Data Transfer Risk
•The score is calculated from data flow information. Follow the same three-step process: Review Score → Start Assessment → Download Risk Report.
•Steps 1 and 3 show as Unavailable until the record contains sufficient data transfer information from the Build Data Flow tab.
AI Risk
•Follow the same three-step process: Review AI Risk Score → Complete AI Risk Assessment → Review Residual AI Risk Score.
•The AI Risk score reflects the AI disclosure made in the Purposes & Elements tab. Click Review Score to inspect the calculated risk level.
9.2 Manage Linked Assessments
•Review the assessment summary counters at the bottom of the tab: Open, In Progress, Pending Approval, Failed, Approved, and Total.
•To link an existing assessment, click + Add and search for it by name.
📋 Note: Risk scores
are calculated automatically based on data entered across all
tabs. A score showing as Incomplete or Unavailable means more
information is needed in earlier tabs.
Step 10 — Complete the Tags tab
Tags classify the Business Process Record for easier searching, filtering, and reporting across the platform.
•Click the Tags tab. The tag groups configured for your account are displayed, each as a labelled dropdown.
•For each tag group, click the dropdown and select the appropriate value or values. Selections are saved automatically.
•Repeat for all tag groups shown on the tab.
📋 Note: Tag groups
and values are managed by your administrator. If a required tag
group or value is missing, contact your administrator.
Finalize and Publish the Record
Once all tabs are complete, change the record status from Draft to make it active in the system.
1
Review each tab to confirm all required fields are complete
and all information is accurate.
2
In the top-right corner, click the
Draft status
dropdown.
3
Select the appropriate status for your workflow (e.g.,
Published, Active, In Review). Available options depend
on your organisation's configuration.
4
To set a revalidation date, click
Edit Revalidation Date
and select a date from the calendar.
5
Click Close
to exit the Business Process Record form. All changes
are saved automatically, confirmed by the "All changes
saved" indicator in the top bar.
📋 Note: The record
is saved automatically as you navigate between tabs. You can
close and return to any incomplete record from the Business Processes
list at any time.
Adding Owning Organizations and Contacts
The Owning Organizations and Contacts section identifies which organizational entity owns the record and assigns the key contacts responsible for it — including the Data Protection Officer (DPO), EU Representative, and Business Process Owner.
1
Click Add. The
Add New Owner dialog appears.
2
Enter the following information:
Field
Required?
Description
Owning Entity
Required
Select the organization that owns this Business Process Record from the list of entities configured in your organization hierarchy.
Role
Optional
Select the role this entity plays (e.g., Data Controller, Data Processor).
Reporting Organization for Article 30 Report
Optional
Check this box if this entity should be listed as the Reporting Organization in the Article 30 Record of Processing Activities report.
3
Review the
Data Protection Officer and EU Representative
section. It displays contacts already linked to the
selected owning entity.
•Review
the DPO & EU Representative table: Name,
Role, Email, and Include in A30 Report.
•If
the table shows "No DPO or EU Representative
Contacts available," none have been configured
for this entity yet.
•To
add or update contacts, click
Update DPO or EU Representatives.
Complete the update and return to the dialog.
📋 Note:
DPO and EU Representative contacts are managed at
the organization level. Changes made via
Update DPO or EU Representatives
apply across all records linked to that owning entity.
4
Review the
Business Process Owner
section. Confirm the correct owner is displayed. If it
is empty or incorrect, contact your TrustArc administrator
to update the assignment.
5
Click Save.
The dialog closes and the new owning organization
appears as a row in the
Owning Organizations and Contacts table.
Confirm the row displays correct values across all
columns: Name, Role, DPO & EU Representatives,
Reporting Organization, Record Owner Name, Email,
and Department.
📋 Note:
Changes to Owning Organizations and Contacts are
saved automatically when you click
Save in
the dialog. You do not need to save the entire record
separately.
TrustArc Data Mapping & Risk Manager · Creating a Simple Business Process Record · support.trustarc.com