Pathway: AI for data protection and privacy officers Module 2 of 5
Mapping where personal data goes
How to draw a simple map of what personal data an AI tool receives, where it goes, who can see it and how long it stays.
Last reviewed: . Reviewer: Muhammad Asadullah.
Why this matters
You cannot protect data you cannot see. When an office adopts an AI tool, personal data starts to travel: from a case file to a screen, from the screen to a provider's servers, from the servers perhaps to another company or another country. A simple map of that journey is the most useful thing a privacy officer can produce. It turns "is it safe?" into questions that have answers.
A one-page data flow map
For each AI use in your office, fill in one row.
| Question | Example answer |
|---|---|
| What is the task? | Draft replies to citizen complaints |
| What personal data is involved? | Names, phone numbers, complaint details |
| Where does it come from? | The complaints register |
| Who receives it? | The tool provider and any companies it uses |
| Where is it stored and processed? | Country and provider named in the terms, or unknown |
| How long is it kept? | Stated period, or unknown |
| Who can see it? | Staff of the provider, our administrators, other users in the account |
| Can we delete it? | Yes (on request), no or unknown |
| Who approved this use? | A named officer, or nobody |
An "unknown" is not a failure. It is a finding. It tells you what to ask next.
Cut the data down first
Before mapping a flow, ask whether it needs personal data at all. The principle of data minimisation says to use only what the task needs. A reply to a complaint can often be drafted from the complaint's topic alone, with the name, number and address added by the officer afterwards on the office computer.
When a task does need example data, use anonymisation with care. Removing a name is rarely enough: a business type, an area and a date can together point to one person. That is re-identification. Invented examples are safer than edited real ones.
Where the data lives
The country where data is stored and processed matters, because the law of that country and the provider's terms may govern it. This is part of data sovereignty. The question "where?" is also a question about continuity: a service run from abroad can change its terms or availability. Our Sovereign AI guide explains the wider picture.
Keep and delete
Every flow should have an answer to "how long?" and "how do we remove it?". Check that deleting a conversation in the tool deletes it at the provider as well and whether backups and logs are kept. Check that your office has a way to delete data when a person asks, or when a record is no longer needed under your department's rules. For official records, follow the guidance in AI and record-keeping, because some records must be kept and some must not be sent out at all.
Try it
Choose one task in your office where an AI tool is used or proposed. Fill in the table above for it. Mark every "unknown" in red. Then write the three questions you would send to the provider first.
Check yourself
- What is the purpose of a data flow map?
- Why is an "unknown" in the map useful?
- Why is removing a name not always enough to anonymise data?
Answers: (1) To show what personal data an AI use sends, where it goes, who can see it and how long it stays, so risks can be judged. (2) It shows what you still need to ask or find out. (3) Other details in combination can still identify the person.