Data Flow

A data flow traces personal data from collection through processing to retention and erasure. The documented flow records source (the collection point), each system that stores or transforms the data, each processor and sub-processor involved, each cross-border transfer, and the lawful basis for each step. For a typical SaaS customer record, a complete data flow might include: web form (collection) → CRM (storage) → marketing platform (processing) → data warehouse (analytics) → BI dashboards (reporting) → cold storage (retention) → secure delete (erasure).

GDPR Article 30, DPDP Rule 11 (SDF obligations), PDPA (Transfer Limitation), and the EU AI Act all require you to map data flows for regulated processing. Data flow diagrams are the visual artefact; the underlying flow data lives in the Record of Processing Activities and feeds the DSR response pipeline (where did this subject's data go?), the breach workflow (which systems are in scope?) and the transfer register (which flows are cross-border, under which safeguard?).