Overview
A comprehensive international data flow map is the foundational prerequisite for any cross-border transfer compliance programme. GDPR Article 30 requires controllers and processors to document transfers to third countries or international organisations. Beyond regulatory compliance, a data flow inventory enables identification of unprotected transfers, assignment of appropriate transfer mechanisms, and ongoing monitoring of data movement across jurisdictions. This skill provides a structured methodology for conducting a system-by-system data flow inventory, identifying all third-party recipients, assigning transfer mechanisms, and performing gap analysis.
Data Flow Inventory Methodology
Phase 1: System Inventory
Identify every information system, application, and service that processes personal data within the organisation.
System categories at Athena Global Logistics:
| Category | Systems | Personal Data Processed |
|---|---|---|
| Enterprise Resource Planning | SAP S/4HANA (hosted Frankfurt DC) | Employee data, customer data, supplier data, financial data |
| Transport Management | CargoWise One (SaaS, hosted Sydney) | Customer shipment data, consignee data, customs broker contacts |
| Customer Relationship Management | Salesforce (SaaS, hosted Frankfurt) | Customer contacts, communication history, sales pipeline |
| Human Resources | Workday (SaaS, hosted Dublin) | Employee personal data, payroll, benefits, performance, recruitment |
| Email and Collaboration | Microsoft 365 (SaaS, hosted EU DC) | Employee communications, contacts, calendar, file storage |
| Warehouse Management | Manhattan Associates (hosted Frankfurt DC) | Warehouse worker IDs, shift schedules, access logs |
| Fleet Management | Fleetio (SaaS, hosted US) | Driver names, licence numbers, GPS tracking data, vehicle assignments |
| Customer Portal | Custom web application (hosted Frankfurt DC) | Customer login credentials, shipment tracking, document uploads |
| Analytics Platform | Snowflake (SaaS, hosted Frankfurt) | Aggregated operational data, pseudonymised customer analytics |
| IT Service Management | ServiceNow (SaaS, hosted Amsterdam) | Employee IT tickets, contact details, device assignments |
Phase 2: Data Flow Identification
For each system, trace every flow of personal data that crosses a national border.
Data flow tracing methodology:
- Inbound flows: Where does personal data enter the system from? (user input, API integrations, file imports, email)
- Internal processing: Where is data stored and processed? (primary data centre, disaster recovery site, development/test environments)
- Outbound flows: Where does personal data leave the system to? (third-party integrations, data exports, email transmissions, backup replication)
- Sub-processor chains: For SaaS systems, identify the provider's sub-processors and their locations.
- Support access: Identify any remote support arrangements where third-country support staff may access personal data.
Athena Global Logistics example data flow register (excerpt):
| Flow ID | Source System | Source Location | Destination | Destination Country | Data Categories | Legal Basis for Processing | Transfer Mechanism |
|---|---|---|---|---|---|---|---|
| DF-001 | SAP S/4HANA | Frankfurt, DE | Athena Logistics (HK) Ltd — local SAP instance | Hong Kong SAR | Customer names, addresses, consignment data | Art. 6(1)(b) contract | SCCs Module 1 |
| DF-002 | CargoWise One | Sydney, AU | Athena Global Logistics GmbH — API pull | Australia | Shipment status, consignee details | Art. 6(1)(b) contract | EU adequacy decision (implied — no decision for AU; SCCs Module 2 required) |
| DF-003 | Workday | Dublin, IE | Workday Inc sub-processor (US backup DC) | United States | Employee HR data | Art. 6(1)(b) employment contract | EU-US DPF + SCCs backup |
| DF-004 | Fleetio | Atlanta, US | N/A (primary processing in US) | United States | Driver names, licence numbers, GPS data | Art. 6(1)(f) legitimate interest | EU-US DPF (verify certification) |
| DF-005 | SAP S/4HANA | Frankfurt, DE | Athena Freight Services India — SFTP batch | India | Employee data (payroll, benefits) | Art. 6(1)(b) employment contract | SCCs Module 1 |
| DF-006 | Custom portal | Frankfurt, DE | TransPacific Freight Solutions — API | Hong Kong SAR | Customer shipment data | Art. 6(1)(b) contract | SCCs Module 2 |
| DF-007 | Microsoft 365 | EU DC | Microsoft Corp sub-processors (global) | Multiple (US, SG, IE) | Employee emails, files | Art. 6(1)(b) contract | EU-US DPF (US); SCCs (SG) |
Phase 3: Third-Party Identification
Catalogue all third parties (processors, sub-processors, joint controllers, independent controllers) that receive personal data through international transfers.
| Third Party | Role | Country | Data Received | Purpose | Contract Reference |
|---|---|---|---|---|---|
| TransPacific Freight Solutions Ltd | Processor | Hong Kong SAR | Customer shipment data | Freight consolidation and customs clearance | DPA-2025-001 |
| CloudVault Asia Pte Ltd | Sub-processor (of TransPacific) | Singapore | Customer shipment data (hosting) | Cloud infrastructure | Sub-processor agreement via TransPacific |
| Pinnacle Data Services Co Ltd | Sub-processor (of TransPacific) | Thailand | Customs documentation data | Data entry and validation | Sub-processor agreement via TransPacific |
| Athena Freight Services India Pvt Ltd | Controller (intra-group) | India | Employee HR data | Local employment administration | Intra-group DPA-2024-005 |
| Workday Inc | Processor | Ireland (primary), US (backup) | Employee HR data | HRIS platform | DPA-WD-2024-001 |
| Fleetio Inc | Processor | United States | Driver data | Fleet management | DPA-FL-2024-003 |
| Microsoft Corporation | Processor | EU, US, Singapore | Employee email and files | Email and collaboration | DPA-MS-2024-001 |
Phase 4: Transfer Mechanism Assignment
For each identified international data flow, assign the appropriate transfer mechanism:
For each flow:
1. Check: Does the destination have an EU adequacy decision?
→ YES: Record "Adequacy Decision" as mechanism. Done.
→ NO: Continue.
2. Check: Is the importer DPF-certified (for US transfers)?
→ YES: Record "EU-US DPF" as mechanism. Recommend SCCs as backup.
→ NO: Continue.
3. Check: Are SCCs in place between the parties?
→ YES: Record "SCCs Module X" as mechanism. Verify TIA completed.
→ NO: Continue.
4. Check: Are BCRs in place covering the transfer?
→ YES: Record "BCRs" as mechanism. Verify scope covers the data.
→ NO: Continue.
5. Check: Does an Art. 49 derogation apply?
→ YES: Record "Art. 49(1)(x)" as mechanism. Document justification.
→ NO: FLAG AS UNPROTECTED TRANSFER — immediate action required.
Phase 5: Gap Analysis
Identify transfers that lack a valid transfer mechanism:
| Gap Type | Description | Priority | Remediation |
|---|---|---|---|
| No mechanism | Transfer occurring without any Art. 45/46/49 basis | Critical | Suspend transfer or execute SCCs within 30 days |
| Expired mechanism | SCCs based on superseded 2010/2021 versions; DPF certification expired | High | Renew mechanism within 60 days |
| Missing TIA | SCCs in place but no documented TIA | High | Complete TIA within 30 days |
| Incomplete documentation | Mechanism exists but Annex fields are incomplete | Medium | Complete documentation within 60 days |
| Sub-processor gap | Importer uses sub-processors not covered by SCCs | High | Extend SCC coverage or require importer to execute Module 3 SCCs |
| Undiscovered flow | Data flow identified during mapping that was not previously known | High | Assess, assign mechanism, and document within 30 days |
Data Flow Visualisation
Visualisation Approaches
-
Geo-map visualisation: Plot data flows on a world map with colour-coded lines:
- Green: Transfer covered by adequacy decision
- Blue: Transfer covered by SCCs/BCRs with completed TIA
- Yellow: Transfer covered by mechanism but TIA pending or in review
- Red: Transfer lacking valid mechanism — immediate action required
-
System-centric diagram: For each major system, draw a diagram showing all inbound and outbound data flows with destination countries and mechanisms.
-
Third-party relationship map: Network diagram showing the organisation at the centre with all third parties and data flows radiating outward, grouped by jurisdiction.
-
Transfer register dashboard: Tabular view with filtering by mechanism type, destination country, risk level, and review status.
Ongoing Maintenance
- Trigger-based updates: Re-map data flows upon: new system implementation, new vendor onboarding, corporate restructuring, new country operations, new data categories.
- Periodic review: Full data flow inventory review at least annually.
- Automated discovery: Implement network monitoring and data loss prevention (DLP) tools to detect undocumented cross-border data flows.
- Integration with RoPA: Data flow map feeds directly into the Art. 30 Records of Processing Activities.
- Integration with vendor register: Third-party data recipients map feeds into the vendor management and DPA tracking system.