StartUppLegally · Published · Editorial policy
General business preparation, not legal advice. Transaction and jurisdiction-specific conclusions require professional review.
What is a personal data flow record?
A personal data flow record describes how information about individuals enters a business process, where it is used and who receives or can access it. It helps advisers understand the operating facts before assessing applicable privacy obligations. The record should be sufficiently specific to identify questions, while avoiding unnecessary copies of actual personal information. It is not, by itself, a finding of legal compliance.
Choose a defined business process
Begin with a process such as recruitment, customer onboarding or service support. Identify the relevant entity, systems and responsible teams. Describe the journey from initial collection to later use, sharing and disposal or retention. Separate the way the process is intended to operate from current practice where those differ. An accurate account of a limited process is more useful than an organisation-wide diagram built on unverified assumptions.
Record purposes and categories
Describe the categories of information involved and why the business uses them. Identify the source and the point at which information is collected or obtained from another party. Use fictional examples or category descriptions in working materials shared widely. The relevant legal basis, notice requirements and other obligations need separate assessment; an internal statement that information is useful does not determine whether a particular use is appropriate.
Identify recipients, providers and locations
List the systems, service providers and other entities involved, together with their proposed or actual role. Locate the relevant contracts and service descriptions. Explain access arrangements, external support and any international element without assuming that a vendor’s standard terms settle every question. Flag unknown locations or onward providers. Counsel needs reliable facts about the arrangement before advising on its legal treatment.
Connect retention, security and individual requests
Explain how long records are kept in practice, who can change access and what happens when an account or relationship ends. Identify the teams receiving complaints or requests concerning information. Describe existing security and incident procedures at a level suitable for the advisory discussion. Do not insert a universal retention period or response deadline from a generic checklist. Applicable duties and timelines must be checked against the current framework and the particular activity.
A fictional recruitment example
A business receives application forms through one provider while candidates send CVs to a recruitment mailbox. Its record should distinguish the form submission, the provider’s processing and the copies held in email. It should identify who has access and how records are managed after recruitment. The fact that the website has no application database does not mean that no personal information is processed or retained elsewhere.
Use the record for a current legal review
Provide a concise flow description, relevant notices and contracts, known gaps and the decisions required. MeitY publishes the DPDP legislation, rules and implementation material; commencement and applicability must be checked for the provision and activity under review. This article does not state that every obligation commenced on the same date. Update the flow when systems, providers or purposes change and retain the assumptions on which advice was given.
References
Related Insights
Related Practice
IT Contracts & Data Privacy