---
title: "Map a vendor’s data flows for a privacy review"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/map-a-vendor-s-data-flows-for-privacy-impact/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A24-B7-3-US"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "green"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Map a vendor’s data flows for a privacy review

> From the contract, the data-flow diagram, and the system list the lawyer supplies, list each category of data, the system that holds it, the recipient, and the purpose the document states.…

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/map-a-vendor-s-data-flows-for-privacy-impact/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Green: AI drafts, lawyer checks |
| How AI is used | From the contract, the data-flow diagram, and the system list the lawyer supplies, list each category of data, the system that holds it, the recipient, and the purpose the document states. Do not decide whether a transfer is lawful. |
| What the lawyer must review | Rule 1.6(a) forbids revealing information relating to the representation unless the client gives informed consent, the disclosure is impliedly authorized, or paragraph (b) permits it. Rule 1.6(c) requires reasonable efforts against unauthorized access. Formal Opinion 512 requires the lawyer to understand whether a tool retains prompts or uses them to train a model. Cal. Civ. Code § 1798.140(ag) defines a service provider as a person that processes personal information on behalf of a business under a written contract with the stated prohibitions. |
| Written for | United States |
| Applies to | [Map a vendor's data flows for privacy impact](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/map-a-vendor-s-data-flows-for-privacy-impact.md) |

## Checking plan

- What the AI does: From the contract, the data-flow diagram, and the system list the lawyer supplies, list each category of data, the system that holds it, the recipient, and the purpose the document states. Do not decide whether a transfer is lawful.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- No federal adequacy or cross-border transfer regime was opened for this version. The map records what the papers say.
- Customer content and prompts stay in the matter file. Do not paste them into a public tool.

## Sources

- [ABA Model Rule 1.6, Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)
- [Cal. Civ. Code § 1798.140, including the service-provider definition](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Cross-border disclosure assessment for a technology vendor (APP 8 and s 16C checklist and record)](https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/app-8-cross-border-disclosure-assessment.md) | Checklist | Yellow | A checklist and file record for deciding whether sending personal information to an overseas or offshore-hosted vendor is a use or a disclosure under APP 8, which exception (if any) applies, and the… |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*