Data Flow Map

A data flow map is a record of where data comes from, which systems it passes through, who processes it on your behalf and where it physically ends up. It is the artefact that lets an organisation answer a question that is otherwise surprisingly hard: if this customer's data is in our product, which third parties have seen it? AI features make that question sharper, because they add hops that are easy to miss. A prompt built from a support ticket may include text from a CRM, retrieved passages from a document store and a system prompt from a config service, then travel to a model provider in another jurisdiction, and be copied again into an observability tool and a prompt log. Each of those is a processor or a storage location, and none of them appears in the diagram the product was originally designed against. A map that earns its keep records more than boxes and arrows. For each flow: what categories of data move, why, on what legal basis where that applies, which processor or subprocessor receives it, in which region, how long they keep it, and how it gets deleted. That is close to the information a privacy notice, a DPIA and a customer security questionnaire all need, which is why maintaining one map beats reconstructing the same facts three times for three audiences. The practical trap is a map drawn from architecture documents rather than from what is running. Diagrams describe intent; a debug export added last quarter, a vendor's new AI feature that started calling out, or a copy of production data in a staging environment do not appear in them. Confirming the flows against egress logs, subprocessor lists and the AI system inventory is what turns the map from a design document into a record. Use it as the thing that gets updated when the architecture changes, and keep it next to the inventory rather than in a compliance archive. Its value is almost entirely in being current: a map that describes last year's system will answer a regulator, a customer and an incident responder confidently and wrongly.