DATA GOVERNANCE

How do you map an app's data flows?

Track the complete processing path, including systems beyond the primary database.

Understand the work before you invest in it.

MAP THE WHOLE SYSTEM

Data can leave the primary database.

An application's data location cannot be verified by checking the database region alone. A form may reach an API, analytics service, AI model provider, payment platform, notification service or support system. Backups and logs may be stored by different suppliers.

For each data flow, document the origin, destination, data categories, processing purpose, controller and processor roles, region, retention period, security controls and any transfer mechanism that needs examination.

Maintain the map as a living system record. A new AI tool, metrics SDK or managed service can change the processing boundary even when the visible user interface is unchanged.

COMMONLY MISSED

Four less obvious processing locations

AI PROVIDERS

Prompts and retrieved documents

Check whether requests may include customer or member information, where they are processed and how long they are retained.

OPERATIONS

Logs and observability

Application logs may contain identifiers, errors, request metadata or unintended personal information.

SUPPORT

Administrative access

Remote support from another country may introduce processing or access considerations separate from storage.

BACKUPS

Recovery copies and archives

Review snapshot regions, restore access, retention windows and deletion at end of service.

How should the map be maintained?

Require an architecture review whenever a new processor, storage region, data category or external API is added. Keep signed agreements and current data-flow evidence with the system's operational record. Revisit data minimisation and access rights as the application changes.

Does a completed map establish GDPR compliance?

No. It supports the assessment but does not replace lawful-basis analysis, transparency obligations, rights handling, transfer assessments, contracts and appropriate organisational controls. For current UK guidance consult the Information Commissioner's Office.