Data Flow and Usage Diagrams

Data Flow and Usage Diagrams (DFUDs) are structured visual artifacts that map how personal and sensitive data moves through an organization's systems, processes, and external boundaries — documenting not just the path of data, but the purpose of each movement, the transformations it undergoes, the parties that handle it, and the controls governing its use. A Data Flow Diagram (DFD) charts technical movement: where data originates (sources), how it is processed (transforms), where it persists (data stores), and where it exits (external entities). A Data Usage Diagram extends this by layering in business context: the stated purpose for each flow, applicable retention periods, legal basis for processing, and access control constraints. Together they form the documentary backbone of a privacy governance program — translating invisible data operations into an auditable, shareable artifact. They are NOT: (1) network topology diagrams — they map data movement, not infrastructure; (2) entity-relationship diagrams — they map flows, not schema; (3) standalone process flowcharts — they must include data stores and external entities; (4) one-time compliance deliverables — they are living documents requiring active maintenance.