Flowz is a web-based tool for registering information assets and recording all flows of information an organisation uses to perform its business functions

Based on the ISO27005 approach to information risk management and now redesigned for the new General Data Protection Regulation (GDPR), Flowz allows the organisation to record all of its information, whether it is at rest or flowing through a business process.

Flowz allows you to record your information assets, person by person, team by team and department by department, mapped to your fully configurable hierarchy, providing you with a realistic, up to date view of the information assets your organisation holds.  Additionally, you can record and risk assess all the flows of data from that asset, be it via email, post or direct electronic transfer, with information asset owners and administrators approving those flows

Essentials is designed for small businesses which, due to the categories of special categories of data they process (GDPR article 9), get caught up with the GDPR article 30 (5) requirement to maintain records of processing. We have in mind doctors, dentists, small charities that focus on health care. This version only records the minimum information necessary to satisfy article 30, but includes linkages to article 32.

As Essentials, plus the Business subscription is designed for larger businesses, which may have greater risks and what to see the risk indicator values that are generated from the attributes of their data processing. They may also be small organisations for whom personal data processing is core to their operation, or specialist businesses that process special categories of data because it is fundamental to their objectives. These organisations may voluntarily maintain records of processing because it is good practice, rather than only because it is required by law.

As Business, but in addition the Premium Business subscription is designed for larger organisations, typically public-sector or having more than 250 employees. They have a statutory duty to maintain records or processing and want to understand their risk exposure, which is presented back to them through the dashboards and reporting. These might also be smaller regional government organisation, charities, smaller health bodies and the like. These organisations can be dynamic environments, and this version allows changing of organisational structure and staffing without re-entering data.

As Business Premium, plus the Enterprise version can accommodate the needs of larger and more complex organisations. These might have multiple business units and processing activities that may be siloed or spread across multiple organisations in multiple locations, including multi-national. The system allows different rule sets to be applied, such that an operation in one country or industrial sector, might have different risk values and rules to another.