A regulator asks where a specific customer's personal data is held. Which artefact answers that and what must it include?
Show the full answer Hide the answer
What is being tested
Whether you know which artefact tracks information rather than control, and whether you can enumerate the stores people forget.
The artefact
A data flow diagram with data classification and stores marked. It traces information rather than control: what data exists, where it is stored, how it moves, and which trust and jurisdictional boundaries it crosses.
No component or deployment diagram answers this, because both describe structure rather than information.
What it must include
Every store, including the forgotten ones. This is where the value is, because most privacy failures are not in the primary database:
- The primary database and its replicas.
- Caches.
- Logs — the least controlled and most frequently overlooked personal data store in most estates.
- Search indexes.
- Data warehouse and lake.
- Event logs and message queues.
- Backups, with their own retention.
- Analytics and product tooling.
- Third-party processors — CRM, email, support, payments.
- Machine learning training datasets.
- Object storage, including derived thumbnails and exports.
Data classification per flow — personal, confidential, public — so it is clear which flows matter.
Trust and jurisdictional boundaries, so residency questions and threat modelling are both answerable from the same artefact.
Retention per store, since the same data has different lifetimes in different places.
The second use, which justifies maintaining it
Threat modelling. Walking each trust boundary crossing and applying the standard threat categories — spoofing, tampering, information disclosure, denial of service, elevation of privilege — is the most productive form of threat modelling available, and it takes a couple of hours.
One artefact, two obligations satisfied.
The prerequisite this reveals
If you cannot produce this diagram, you cannot answer deletion, access or residency requests reliably — and that is a finding in itself. A maintained data inventory is the difference between a one-day response and a two-week archaeology exercise.