“A GDPR data flow for an online store: a customer sends account and checkout data to the storefront, which sends an order request to an order service; the service updates the customer database, writes the order and audit log, sends payment authorization to a payment provider, and sends shipping details to a fulfillment partner. Show all processor boundaries.”
Read the decisions behind it.
Payment and fulfillment services sit outside store systems.
Customer, order and audit data use separate stores.
Payment and shipping details leave the order service.
Use this DFD to begin documenting customer data flows for an ecommerce privacy review.
Other examples in this family.
Common questions
Why are payment and fulfillment shown separately?
They usually receive different data for different purposes and may be separate external processors.
What does the audit log represent?
It represents a record of order activity kept apart from the main order database.
Is this a complete DPIA?
No. It is a flow diagram that can support a DPIA alongside risk, purpose and legal-basis analysis.