Data Flow Mapping: Drawing the Picture Your Privacy Program Depends On
You cannot answer an access request, assess a transfer, or scope a breach without knowing where the data actually is. Most companies find that out during the incident.
A data flow map records where personal information enters your organization, every system it passes through, everyone it is shared with, where it rests, and when it is deleted. It is unglamorous and it underpins almost everything else. Access requests, transfer assessments, retention schedules, breach scoping, and vendor reviews all start by answering a question the map already answers.
Companies skip it because it looks like a documentation project. Then a breach happens, and the first forty-eight hours are spent working out which systems held the affected records, which is the worst possible time to be drawing the map.
What does a usable map contain?
One row per flow, not per system. That distinction saves you weeks.
| Element | Example |
|---|---|
| Data subject type | Customer, employee, patient, applicant |
| Categories | Contact details, payment data, health information |
| Entry point | Web form, imported file, integration, phone call |
| Systems it passes through | CRM, help desk, data warehouse, analytics |
| Third parties it reaches | Named processors and what they see |
| Storage location | Country and service |
| Retention | The rule, and whether it is enforced or aspirational |
| Legal basis or purpose | Why you hold it at all |
| Owner | Who can answer questions about this flow |
The retention column carries a deliberate honesty requirement. Write what actually happens, not what the policy says. A map that records "seven years per policy" for data nobody has ever deleted is worse than no map, because it will be relied on.
How do you build it in a week?
Follow the people, not the technology. Interviews beat scanners at this stage, because scanners find where data is and people explain why it went there.
Day one and two: the intake points. List every way personal information enters. Web forms, imports, integrations, email attachments, phone notes, paper. For a typical small company this is between eight and twenty entry points, and two or three of them will surprise you.
Day three: follow each one forward. For each entry point, ask which system receives it, what copies get made, and who else sees it. Copies are the part people forget. A record that lives in your CRM also lives in the analytics export, the backup, the support ticket, and someone's spreadsheet.
Day four: the outbound edges. Where does data leave? Processors, analytics, email platforms, payment providers, model providers behind AI features. Cross-check this against your vendor inventory, and expect the two lists to disagree the first time.
Day five: write down what you cannot answer. The unknowns are the most valuable output of the exercise. A map with six honest question marks and an owner for each is a plan. A map with no gaps is usually a map that was not tested.
Where do the surprises usually turn up?
Four places, consistently.
Analytics and marketing exports. Personal information leaves for a purpose nobody assessed, often to a jurisdiction nobody reviewed.
Backups. They hold everything, including the records you deleted from production, and they are frequently out of scope in retention schedules by accident rather than design.
Spreadsheets and local copies. Someone exported the customer list for a project in 2024. It is still in a shared drive.
AI features. The newest edge and often the least documented, because it was added by engineering rather than procured. If personal information reaches a model provider, that is a flow and it belongs on the map.
What do you do with the finished map?
Wire it into the obligations it serves, or it becomes a document that ages badly.
An access request should be answerable by reading the map, so the response is complete rather than covering only the systems the responder remembered. A cross-border transfer assessment should be triggered by any flow whose storage location leaves Canada. A retention schedule should apply to every system named in the map, backups included. A breach should be scoped by looking up the affected flow, not by convening a meeting to reconstruct it.
Review the map when systems change, not on a calendar. The calendar review catches drift eventually; the change trigger catches it immediately, and changes are what invalidate maps.
For the closely related record most Canadian programmes need alongside this, what is a ROPA and why it is the foundation of every privacy program covers the processing register itself.
This is general information, not legal advice.
Valdra links the flows to the vendors, transfers, retention rules, and assessments they trigger, so the map stays connected to the work rather than sitting in a drive. The data discovery view is where it starts.
Frequently asked questions
What is data flow mapping?+
It is the record of where personal information enters your organization, which systems it passes through, who it is shared with, where it is stored, and when it is deleted. One row per flow rather than per system keeps it usable.
Is data flow mapping required in Canada?+
No law names it as a standalone obligation, but it underpins ones that are enforced. Answering an access request completely, assessing a transfer outside Canada, applying a retention schedule, and scoping a breach all require knowing where the data actually is.
How long does it take to map data flows?+
About a week for a small company if you interview people rather than run scanners: two days listing entry points, one following each flow forward, one on outbound transfers, and one recording what you could not answer.
Where do most companies find surprises?+
Analytics and marketing exports leaving for unassessed purposes, backups that still hold deleted records, spreadsheets exported years ago and never cleaned up, and AI features that send personal information to a model provider nobody documented.
Should the retention column say what the policy requires?+
No, it should say what actually happens. A map recording seven years per policy for data nobody has ever deleted is worse than no map, because people will rely on it during an incident or an access request.
AI governance and privacy compliance, simplified.
Valdra helps Canadian companies govern AI and meet PIPEDA and Law 25 — hosted in Canada.
Try Valdra
