Data flow diagram or register identifies all data types, sources, destinations

GDPR Art. 30 requires controllers to maintain Records of Processing Activities (ROPA), and a data flow register is the practical implementation of that requirement. ISO-27001:2022 A.5.9 requires an inventory of information assets; NIST SP 800-53 PM-5 requires an information system inventory. Without a register, it is impossible to answer a supervisory authority's first question during an audit: "What personal data do you process and where does it go?" It is also impossible to identify the correct third-party contacts when a breach occurs, scope a deletion request accurately, or assess the impact of adding a new integration. The register is the foundation that makes all other data protection controls auditable.

Create a data register in docs/data-register.md or a shared spreadsheet. A structured table covering all data types, sources, storage locations, processors, and retention periods satisfies the GDPR Art. 30 ROPA obligation.

Data Register:

| Data Type     | Source        | Storage         | Processing       | Recipients         | Retention |
|---------------|---------------|-----------------|------------------|--------------------|----------|
| Email         | Signup form   | users table     | Auth, comms      | SendGrid (email)   | Until del |
| Usage events  | App telemetry | events table    | Analytics        | None               | 26 months |
| IP address    | Web requests  | Server logs     | Fraud detection  | None               | 90 days  |
| Payment info  | Checkout      | Not stored      | Fwd to Stripe    | Stripe             | Never    |
| Session token | Auth flow     | cookies/DB      | Session auth     | None               | Session  |

Update the register whenever you add a new form field, third-party integration, or data processing feature. Link it from your README and privacy policy.