Where there is a need to flow data out of the data store to a processing organisation (as identified in Step 3b) then you need to understand the data requirements of the receiving organisations and map the flows. This is a similar process as was undertaken in Step 2, however now the flows will be considered from the central data store(s) to the individual organisation(s).

If the process requires data to be extracted from the data store and to be sent to organisations undertaking processing, then there will be a need to map those data flows. You should update the inbound data flow map diagram created in Step 2 to map the flow of required data sets from the data store to individual organisations.

This data requirements tool will help you identify your data requirements for secondary use activities.

If however the processing organisations are using analysis tools that link to the data store and data doesn’t actually get extracted and transferred to another system or network, then there are no data flows to map. In addition if the extracts or analysis only produce aggregated statistics and do not contain any data considered personal then they also do not need to be mapped.

Data flow diagrams are likely to be needed for any DPIA or data access application. In order to assist a data flow mapping template is available for download and modification for the care system.


You should now determine and record:

  • the data requirements of each organisation who will need to receive a process personal data in your care system
  • the data flows from the data store to each component organisation

This information can be recorded in the SUDGT input tool and/or data flow diagram.


  • The reference tables utilised in Step 2 to understand your care system's holistic data requirements can now be used to identify the specific types of data required by each organisation undertaking integrated care activities. Simply narrow down the requirements based on the activities being undertaken by each organisation, and their associated service scope.
  • Across an integrated care system, there are likely to be a large volume of data flows, which will need to be individually mapped, however the SUDGT template provides a high-level data flow diagram which allows you to map together similar data flows into pipelines