annatchijova·annatchijova/SKILLS/data-provenance-mapping/SKILL.md

data-provenance-mapping

Skill9 starsChanged 4 months agoLicence not identifiedView on GitHub

You cannot protect, delete, or report on data whose flow you have not mapped — a "delete my data" request, a breach-scope estimate, or a "we don't store PII" claim is only as true as your knowledge of where the data actually went, and it always went further than the schema says: into backups, logs, caches, analytics, data warehouses, search indexes, third-party processors, exports, and derived features. Use whenever the question is where sensitive data lives or goes: "handle this DSAR / right-to-be-forgotten", "did we delete all their data", "what's the blast radius of this breach", "do we store PII", "is this anonymized", "map our data flows", "privacy impact assessment", "we log the request body", "we sent it to this vendor", "GDPR/CCPA data mapping". Sibling of claim-provenance-discipline (a data-handling claim must carry where the data actually is) and credential-material-triage (the "where does it still persist after you rotated it" move, applied to PII); it maps the real flow, not the intended one. It does not write the privacy policy or the deletion job, and never accepts the architecture diagram as evidence of where the data actually went.