Skip to content
NTPU AI Learn

IL 202 · Module 1

Data and Data Flow

Inventory data sources and rights, map data flow end to end, and settle retention, deletion, and ownership.

Start Section 1
  • Duration180 min
  • LevelAdvanced
  • PrerequisiteIL 101 recommended; IL 201 ideally completed
0 / 3 completed

Learning objectives

  • Inventory every data source the project touches, tagging rights, classification, and availability.
  • Draw a data-flow map covering input, processing, storage, and output.
  • Set a retention period, deletion method, and owner for every data item.

Data inventory: sources, rights, and classification

60 min

Data inventory: do you actually have the right to use this?

An IL 201 prototype usually only touches a small, convenient slice of data. Before moving toward a pilot, you must fully list every data item the solution will actually use, not just the ones the prototype is already wired to. The point of a data inventory is not a tidy list; it is finding which data items lack clear authorization for how they are being used.

Data inventory fields (example from the shared synthetic case SYN-CS-001)
FieldSYN-CS-001 example
Data sourceknowledge_documents.csv (product documentation)
Owner/authorizing unitDemo Service Company A's product team (synthetic role)
ClassificationGeneral business data, no personal data
Current useCited source for drafting knowledge-base replies
Existing authorization scopeLimited to internal customer-service workflow; not authorized for external disclosure of the original text
Known limitationsSome documents are outdated or contradict each other (the outdated_source/conflicting_sources categories in cases_practice.csv)

Warning

Common mistake: treating "the data is in the database" as "we have the right to use it." Existing authorization usually covers only the original use case; whether feeding it to an AI to produce new output is still in scope needs an explicit check, not a default yes.
  1. Step 1
    List every data item the solution will read, produce, or store, not only the ones the prototype already connects to.
  2. Step 2
    Tag each item with a classification (general business / personal / sensitive personal / confidential) and its existing authorization scope.
  3. Step 3
    Flag items with unclear or insufficient authorization as remediation gaps for the Readiness Review to track.

Key takeaway: A data inventory is about finding unclear authorization, not re-copying the data you already use.

Data flow map

60 min

Map the data flow: every step from input to output

A data-flow map must answer: where does data come in, what processing and storage does it pass through, where does it leave the system to, and does it pass through any external service or third-party tool along the way. A path you never drew is usually exactly the risk a governance review misses.

SYN-CS-001 customer-service knowledge assistant data flow (synthetic example)
  1. Agent enters the case description
  2. System looks up matching documents in knowledge_documents.csv
  3. AI tool (external or internally hosted) drafts a reply from the documents
  4. Agent reviews, edits, and sends
  5. The case and draft are logged in the internal case system (with a retention tag)
What every node on the data-flow map must record
NodeMust record
InputData source, whether it contains personal data, whether it was de-identified
Processing/AI toolWhether it is an external service, whether data leaves the organization boundary, whether it is used to train that tool
StorageStorage location, retention period, access permissions
OutputRecipient (person/system), whether it could leak to an unauthorized recipient

Info

If the AI tool is an external service, the data-flow map must explicitly state whether data leaves the organization boundary and whether it is used to train that tool. When either is unknown, the status can only be NOT READY or CONDITIONAL, not an assumed 'probably fine.'

Key takeaway: A data-flow map should let you see whether data leaves the organization boundary; if you can't tell, the map is not complete yet.

Retention, deletion, and ownership

60 min

Retention period, deletion method, and ownership

Every data item needs a clear retention period, deletion method, and owner. "No policy" does not mean unlimited retention; it is a gap that must be closed before the Readiness Review.

Not adequate

Retention: long-term; deletion method: TBD; owner: the IT department.

Adequate

Retention period
Case records are kept for 24 months (per the organization's current customer-service record policy), then enter the deletion process.
Deletion method
The case system auto-flags expired cases; the process owner confirms monthly before deletion runs, and the deletion time and count are logged.
Owner
The customer-service process owner (a named role, not a department name).

Warning

The owner must be a named person or a specific role, not just a department name; reviewers need to know exactly who to contact when something goes wrong.
  1. Step 1
    Fill in retention period, deletion method, and owner for every item in the data inventory.
  2. Step 2
    For items with no existing policy, flag them as gaps with a proposed interim period and an approver, rather than leaving them blank.
  3. Step 3
    Carry this module's data inventory and data-flow map forward as evidence for the data-readiness domain in Module 4's Readiness Review.
Check yourself

The data inventory finds that a data item's existing authorization scope is unclear about whether it covers 'feeding it to an AI to produce new output.' What is the most appropriate response?

The data inventory finds that a data item's existing authorization scope is unclear about whether it covers 'feeding it to an AI to produce new output.' What is the most appropriate response?

Key takeaway: No retention or deletion policy does not mean you can keep data indefinitely; it means the policy gap must be closed before moving on.

Save as PDF

What next?