Data Flow Diagram

A Data Flow Diagram (DFD) is the visual representation of a documented data flow. It typically shows systems as nodes, data movements as arrows, external parties as separate zones, and cross-border transfers as crossings of a jurisdictional boundary. A good DFD includes the data categories flowing on each arrow, the lawful basis, and the processor relationship. DFDs are usually one artefact of a DPIA under GDPR Article 35 or DPDP Section 10(2)(c)(i), and are mandatory inputs to a DPIA when the processing is high risk.

DFDs degrade quickly as the architecture evolves. The common failure mode is a once-produced static DFD that no longer matches reality — tools that generate DFDs from live catalog and lineage metadata keep the diagram current. For breach response specifically, the DFD is what lets the IR team scope which systems and which recipients are affected within the first few hours, before the regulator notification window closes.