Free GDPR Data Flow Diagram

See it work

GDPR data flow diagram examples.

Same tool, four requests. Every drawing below is a real render.

What you type

A GDPR data flow for newsletter signup: a subscriber submits an email address and consent to a signup form, which sends a validated signup to a consent service; the service stores a subscriber record and a consent event, then sends the subscribed contact to an email delivery provider. Show public internet, application and email processor boundaries.

Then tryAdd an unsubscribe request from the subscriber.Add a preference center between the subscriber and consent service.

Threat model (DFD + STRIDE) · Shostack, Threat Modeling (2014) · schematex-threatmodel

Rather start from a finished drawing? Browse 4 threat model templates →

The drawing

What a GDPR data flow diagram is.

A GDPR data flow diagram maps personal data from a person or external source through processes and data stores to any recipients. It shows what crosses a trust boundary, including flows to processors such as a payment, email or support provider.

It is a practical starting point for a privacy review, vendor inventory or DPIA. The diagram records the technical and organizational flow; add the actual purposes, legal bases, retention periods and contracts in the accompanying documentation.

Standard: Shostack, Threat Modeling (2014)
Also follows: STRIDE-per-element · Microsoft SDL · DFD (DeMarco/Yourdon)
Engine: schematex-threatmodel
Editable: Double-click text, drag nodes
Export: SVG · PNG · PDF

Who uses it

Who uses GDPR data flow diagrams.

Privacy and compliance teams

A shared map of personal-data stores, external processors and boundary crossings before a privacy review or DPIA.

HR teams

Onboarding flows that show where employee data is stored and which payroll and identity services receive it.

Product and support teams

Support-ticket flows that identify customer contact data, account lookups, audit records and external case platforms.

How it works

How to make a GDPR data flow diagram in three steps.

Describe it

One paragraph is enough to start.

“A GDPR data flow for newsletter signup: a subscriber submits an email address and consent to a signup form, which sends a validated signup to a consent service; the service stores a subscriber record and a consent event, then sends the subscribed contact to an email delivery provider. Show public internet, application and email processor boundaries.”

See the drawing

Drawn by the right engine.

Say what changes

Every edit keeps a version.

Add an unsubscribe request from the subscriber.

V2 · DRAWN FROM V1, NOTHING RETYPED

FAQ

Common questions

What is a GDPR data flow diagram?

It is a diagram of how personal data is collected, processed, stored and shared. It identifies the people, systems, data stores and external recipients involved.

When is a data flow diagram useful for GDPR?

Use one when mapping processing activities, preparing a DPIA, reviewing a vendor or explaining an architecture to privacy, security and product teams.

What should I label on each flow?

Label the category of data being transferred, such as contact details, payment authorization, account lookup or shipping details. Be as specific as the review needs.

What is a trust boundary?

A trust boundary separates areas with different control or responsibility, such as the public internet, internal systems and an external processor.

Does a data flow diagram make a service GDPR compliant?

No. It supports the analysis by making the data flow visible. Compliance also depends on matters such as purpose, legal basis, security, retention and processor arrangements.

Related tools