“A GDPR data flow for newsletter signup: a subscriber submits an email address and consent to a signup form, which sends a validated signup to a consent service; the service stores a subscriber record and a consent event, then sends the subscribed contact to an email delivery provider. Show public internet, application and email processor boundaries.”
Read the decisions behind it.
Record the consent event in an audit log.
The email provider is outside the application boundary.
The flow starts with an email address and consent.
Use this DFD when documenting a newsletter process for a privacy review.
Other examples in this family.
Common questions
Why include a consent audit log?
It makes the separate record of the consent event visible in the data flow.
What is a processor boundary?
It separates an external service provider from the organization’s own systems.
Does this prove consent is valid?
No. The diagram shows where consent information moves and is stored; the consent process still needs legal review.