Data View design intermediate

Data Flow Diagram

What data moves where, in what form, and how often — the view a privacy or residency question is actually answered from.

Regulatory Remediation Integration Programme Data Platform Build Cloud-Agnostic Healthcare & Pharma Banking & Payments Cross-Industry Architecture Review Board Security Regulator & Audit

flowchart LR
  cust(["Customer"])
  app["Registration<br/><i>process</i>"]
  kyc["KYC Provider<br/><i>external · EU</i>"]
  core["Core Platform<br/><i>process</i>"]
  crm[("CRM store<br/><i>EU region</i>")]
  dwh[("Analytics store<br/><i>EU region</i>")]
  mkt["Marketing SaaS<br/><i>external · US</i>"]

  cust -->|"name, DoB, address, ID image"| app
  app -->|"name, DoB, ID image"| kyc
  kyc -->|"pass/fail, risk score"| app
  app -->|"full profile"| core --> crm
  crm -->|"pseudonymised profile, nightly"| dwh
  crm -->|"email, consent flag, on change"| mkt

What it is

Processes, data stores, external entities and the flows between them — with each flow labelled by the data it carries rather than the protocol. That labelling is what makes it answer questions no other diagram can: which flows carry personal data, which ones cross a border, and what would have to change to stop one of them.

The security variant adds trust boundaries and becomes a threat model. This variant, without them, is the privacy and residency artifact.

When you produce it

For a data protection impact assessment, a residency review, a records-of- processing obligation, or any time somebody asks whether personal data leaves a jurisdiction. Also before a migration, because the flows are the coupling.

Who reads it

Data protection officers and privacy counsel. Regulators and auditors. Architects designing the minimisation.

What good looks like

Every flow names the actual fields or field classes, not "customer data".
Stores are annotated with region and classification.
External entities note where they process, which is frequently not where they are incorporated.
Frequency is on each flow, because a nightly bulk export and an on-change trigger are different risks.

Common mistakes

Labelling flows with protocols. HTTPS tells a privacy reviewer nothing.
Omitting the SaaS tools the marketing team connected themselves.
Ignoring derived data. A pseudonymised extract is still in scope and the diagram should show what was removed.