“A GDPR data flow for newsletter signup: a subscriber submits an email address and consent to a signup form, which sends a validated signup to a consent service; the service stores a subscriber record and a consent event, then sends the subscribed contact to an email delivery provider. Show public internet, application and email processor boundaries.”
Comprenez les décisions qui le sous-tendent.
Record the consent event in an audit log.
The email provider is outside the application boundary.
The flow starts with an email address and consent.
Use this DFD when documenting a newsletter process for a privacy review.
Questions fréquentes
Why include a consent audit log?
It makes the separate record of the consent event visible in the data flow.
What is a processor boundary?
It separates an external service provider from the organization’s own systems.
Does this prove consent is valid?
No. The diagram shows where consent information moves and is stored; the consent process still needs legal review.