By Chantal Lavoie, General Manager, Coginov

Such a project requires a methodical approach that respects confidentiality. Here’s a general approach you might follow:

1. Understand legislation and regulations: Familiarize yourself with personal data protection laws and regulations in your area. This could include laws such as the General Data Protection Regulation (GDPR) in the European Union, or national privacy laws.
2. Identify who is responsible for managing personal data in the municipality: This may include IT, human resources and other departments that collect and process data.
3. Inventory of data sources: Identify all potential sources of personal data within the municipality. This could include databases, paper forms, online applications, surveillance cameras, etc.
4. Data classification : Classify data according to its nature (personal, sensitive, etc.) and purpose (HR, public services, etc.).
5. Data flow mapping: Identify how data flows within the municipality, from collection to storage and subsequent use.
6. Risk assessment: Assess the risks associated with the collection, storage, and processing of personal data. This could include security, privacy, and regulatory compliance risks.
7. Implement safeguards: Develop and implement data protection measures to minimize identified risks. This may include security protocols, privacy policies and staff training.
8. Documentation: Document all stages of the process, including the measures taken to ensure data protection. This may be essential to demonstrate compliance with current regulations.
9. Communication and awareness: Communicate with stakeholders, staff, and citizens to inform them of the measures taken to protect their personal data. Raise staff awareness of the importance of data confidentiality.
10. Audit and continually update: Conduct regular audits to ensure that data protection practices remain effective. Update your procedures in line with changes in legislation or technology.

It is advisable to work in collaboration with data protection experts or legal consultants to ensure process compliance and security. This is where we come in. Coginov offers a complete solution to help you achieve your data protection objectives. Here’s how we can help:

1. Identifying and locating personal data: Using our advanced tools to identify and locate all personal data held by the city, whether stored electronically or in paper form.
2. Data volume and type assessment:

   In-depth analysis to assess the volume and types of personal data collected and stored, enabling you to better understand the scope of your inventory.

3. Risk identification: Comprehensive review of processes for collecting, storing and using personal data to identify risks. This helps to reinforce the security and compliance of your practices.
4. Data flow mapping: Development of a detailed map of personal data flows within your organization, providing a clear visualization of the journey of this data throughout its lifecycle.
5. Compliance recommendations: Provision of specific recommendations aimed at improving your organization’s compliance with data protection regulations, particularly Bill 25. These recommendations are designed to strengthen your data management practices.

Coginov’s approach is guided by in-depth expertise in data protection and complies with current legal and regulatory standards. We are committed to helping you implement robust and secure practices to ensure the protection of personal data within your municipality. Here are just a few of the ways in which Coginov can help you:

• Development and implementation of a comprehensive methodology to identify and locate all personal data held by the city.
• Meticulous collection and analysis of data from various sources, including databases, applications and paper files.
• Careful classification of data according to its nature and degree of sensitivity.
• In-depth assessment of the legal basis for data collection and storage, ensuring compliance with current standards.
• Precise identification of the risks inherent in the collection, storage, and use of personal data.
• Development of a data map, clearly illustrating the flow of personal data within the municipal organization.
• Formulation of strategic recommendations aimed at strengthening the city’s compliance with data protection regulations, particularly Bill 25.
• Providing dedicated training courses for municipal staff, focusing on data protection and the proper management of personal data.

With Coginov, benefit from a methodical and specialized approach to ensuring compliance with data protection standards, while building awareness and skills within your municipal team. The Coginov team has proven experience in conducting personal data inventories and mapping, an understanding of data protection regulations, such as the General Data Protection Regulation (RGPD) and Bill 25 in Quebec. We also hold the ability to develop and implement a comprehensive data discovery methodology. Our experience is backed up by real-life examples from public and municipal organizations as well as the private sector.