Data Flow Diagrams BABOK Technique 10.13: Levels, Notation, Practice
What data flow diagrams are in BABOK 10.13: four elements, context and level 1 diagrams, Yourdon vs Gane-Sarson notation, a worked example, practice and CBAP questions.
Data flow diagrams (DFDs) are models that show where data comes from, which activities process it, and whether the results are stored or passed to another activity or external entity. That is the purpose IIBA gives for technique 10.13 in the BABOK Guide v3 [1]. A DFD has four elements: externals, processes, data stores and data flows. For the Certified Business Analysis Professional (CBAP) exam, know the levels and the connection rules.
Why data flow diagrams matter on the CBAP exam
DFDs matter on the exam because scenario questions ask you to pick the model that fits the problem, and a DFD fits when the question is about data moving between systems and people. The CBAP exam has 120 case-study and scenario-based multiple-choice questions in 210 minutes [2].
CBAP fact
Detail
Questions
120 case-study and scenario-based multiple-choice [2]
Time
210 minutes [2]
Experience required
7,500 hours in the last 10 years [2]
Technique section
BABOK Guide v3, 10.13 Data Flow Diagrams [1]
Last verified: October 2026, on the IIBA CBAP page and the IIBA KnowledgeHub entry for 10.13.
Our map of all 50 BABOK techniques by knowledge area shows that DFDs appear in Maintain Requirements (5.2), and they are also a standard option when you specify and model requirements in task 7.1. Expect questions on choosing a DFD over another model and on what a DFD cannot show.
The four elements of a data flow diagram
A DFD is built from four elements. The full BABOK section sits behind an IIBA member login, so the definitions below are checked against study summaries of 10.13 [3, 4] rather than quoted from the guide.
Element
What it is
Naming tip
Example
External (entity, source or sink)
A person, system, organisation or device that produces or receives data [3]
Noun
Customer, Bank
Process
A manual or automated activity done for a business reason that transforms data [3]
A collection of data that can be stored and read again later [3]
Noun, often plural
Orders, Price List
Data flow
The movement of data between an external, a process and a data store [3]
Noun
Payment Details
Two rules hold in every notation. Every data flow starts or ends at a process [3, 7], and every external has at least one flow going to or from it [3]. In practice this means three connections are invalid without a process in between: external to external, external to data store, and data store to data store [4].
Levels: context diagram, level 0 and level 1
DFDs are drawn in levels, from one bubble for the whole system down to detailed sub-processes. The top level, the context diagram, represents the entire system and its externals [3]. The next levels break the system into its major processes, their inputs and outputs, and the data stores they use [3, 4].
Level
Shows
Data stores?
Context diagram
The whole system as a single process, with externals and flows around it [5]
No [4]
Level 1
Major processes (1.0, 2.0, 3.0), their flows and the data stores between them [4]
Yes
Level 2 and below
A complex level 1 process decomposed further [4, 5]
Yes
Watch the numbering. Some sources call the context diagram level 0 [5], while others put a separate level 0 diagram below the context diagram [8]. On the exam, focus on the idea, not the number: the context diagram is the highest view, and lower levels add detail.
Lower levels must balance: a parent's inputs and outputs match its child diagram [4]. Aim for about 6 to 9 processes per diagram [7].
DFDs can also be logical or physical. A logical DFD shows the data a business process needs, without technology. A physical DFD shows how the process is implemented, including software, hardware and files [5]. Logical DFDs are often used for the future state, because they do not depend on current physical constraints [3].
Notation: Yourdon and DeMarco vs Gane and Sarson
The two common DFD notations differ only in how they draw processes and data stores; the meaning is the same [5]. Larry Constantine and Ed Yourdon introduced DFDs in the 1970s, and Tom DeMarco, Chris Gane and Trish Sarson later popularised standard symbols [5, 7].
Symbol
Yourdon / DeMarco style
Gane and Sarson style
Process
Circle (bubble) [5, 6]
Rectangle with rounded corners [5, 6]
Data store
Two parallel lines [5, 6]
Open-ended rectangle [5, 6]
External
Rectangle [5]
Rectangle [5]
Data flow
Labelled arrow [5]
Labelled arrow [5]
Some tools label the circle style Yourdon and Coad [5, 6]. The exam tests whether you can read either notation, not who drew which shape.
A worked example: employee expense claims
The fastest way to learn the technique is to draw a small DFD and test it against the rules. The case: a company moves paper expense claims online.
Context diagram. One process, 0 Expense Claim System. Externals: Employee, Line Manager, Payroll System. Flows: Claim Details and Receipt Images from Employee; Approval Decision from Line Manager; Payment Instruction to Payroll System; Claim Status back to Employee.
Level 1 diagram.
Process
Inputs
Outputs
Data stores used
1.0 Submit Claim
Claim Details, Receipt Images (Employee)
New Claim
D1 Claims (write)
2.0 Check Policy
New Claim
Checked Claim, Policy Breach Notice
D2 Expense Policy (read), D1 Claims (update)
3.0 Approve Claim
Checked Claim, Approval Decision (Line Manager)
Approved Claim, Claim Status
D1 Claims (update)
4.0 Schedule Payment
Approved Claim
Payment Instruction (Payroll System)
D3 Employee Bank Details (read)
Now run the checks:
Balancing. The context diagram has Claim Status going to the Employee. At level 1, process 3.0 produces it, so the levels balance. Policy Breach Notice, though, appears only at level 1. Either add it to the context diagram or route it inside the system.
Connection rules. A first draft often shows Line Manager sending approvals straight to Payroll System. That is external to external, which is invalid; the approval must pass through process 3.0 [4].
Orphan stores. D3 Employee Bank Details is read but never written. Someone has to maintain it, so it is either fed by another system (a missing external or flow) or out of scope. Raise it.
Each finding is a requirement question, not a drawing fix, which is why practitioners say DFDs help find missing requirements [10]. To define each flow's fields, pair the DFD with a data dictionary.
What happens in real practice
In practice, few job ads name DFDs, and those that do are mostly business analyst and architect roles.
Signal
What it shows
UK permanent IT job ads citing Data Flow Diagram, 6 months to 12 October 2026 [9]
24 ads, 0.020% of all permanent IT ads; rank 788, down 125 places year on year
Job titles in those 24 ads [9]
Business Analyst 9 (37.50%), Architect 8 (33.33%), Data Architect 6 (25.00%)
Median salary in those ads [9]
£80,000
The sample is small, so treat it as a signal: employers rarely name the technique, and the ads that do sit close to architecture work.
Security teams use the technique too: threat modeling training describes a DFD with data stores, processes, externals, flows and trust boundaries [14].
Experts disagree on data flow diagrams
Practitioners agree on what a DFD contains, but not on how much of it is worth drawing.
1. DFDs are under-used and catch missing requirements. A business analyst with more than 13 years in insurance calls the DFD "often the under utilized tool in the Business Analyst Toolkit" and says non-technical people understand it easily [10]. A CBAP candidate who drew an end-to-end DFD of BABOK inputs and outputs found missing sources, redundant flows and reverse flows that a document matrix had hidden [11].
2. The context level gives most of the value. A BA trainer treats the system context diagram as a DFD at level zero and prefers to draw it during scoping, arguing that thinking about integrations early prevents missed requirements later [12]. On this view, deeper levels are optional.
3. DFDs are for data, not for business activities. The head of a business analysis lab at a software consultancy positions the DFD for data movement and transformation, BPMN for business activities and ERDs for data structure [13]. Study guides add that a DFD has no timing, control logic or loops [4].
4. DFDs get complex and go stale. One training provider warns that DFDs become hard to understand on large systems [8]. A modelling tool vendor argues that a DFD treated as a one-off deliverable drifts from the real system and causes rework [16].
5. The evidence for their value is thin. A 2024 registered report piloted with 41 master's students found that having a DFD did not make a significant difference in most measures of threat validation [15]. The authors say a study with practitioners is still needed.
Positions 1 and 4 clash on readability [8, 10]. Both can be true: a context diagram stays readable, a level 2 diagram of a large system often does not.
Common misconceptions about DFDs
Most exam errors with DFDs come from mixing them up with process models.
A DFD shows sequence. It does not. A DFD has no control flow, no decisions and no loops [7]. If the question needs order, swimlanes or gateways, choose a process model [4]. The difference between DFDs and process models gets its own article in this series.
Externals can exchange data directly. Not on a DFD. Every flow touches a process [3, 7].
The context diagram shows data stores. It does not; stores appear from level 1 down [4].
Practice questions
These three original questions follow the CBAP scenario style.
Question 1. A business analyst must show a sponsor which outside parties send data to a new claims platform and what they receive, before any detailed analysis starts. Which model fits best?
A. Level 2 DFD
B. Context diagram
C. Sequence diagram
D. State model
Answer: B. The context diagram shows the whole system as one process with its externals and flows [5]. A level 2 DFD is far too detailed for scoping, and sequence and state models answer different questions.
Question 2. While reviewing a level 1 DFD, the analyst sees an arrow from the Customer external straight to the Orders data store. What is the best response?
A. Accept it, because customers create orders
B. Replace the data store with an external
C. Add a process between the Customer and the Orders store
D. Move the flow to the context diagram
Answer: C. Every data flow must start or end at a process [3, 7], so the analyst adds a process such as Place Order.
Question 3. Stakeholders want to see who approves a refund, in what order the steps happen and what happens when a refund is rejected. Why is a DFD a weak choice?
A. It cannot show external entities
B. It does not show sequence or decision logic
C. It cannot be decomposed into levels
D. It is only used for physical system design
Answer: B. A DFD shows data movement and transformation, not order or decisions [4, 7]. A process model fits this need better.
Conclusion: the gap between BABOK and real data flow diagrams
The BABOK technique is used in practice, but mostly at its top level and also outside business analysis.
Area
Standard
Reality
Delta
Levels
Context diagram plus decomposed levels [1, 3]
Context level drawn during scoping; deeper levels optional [12]
Reduced to context diagram
Use for completeness
DFDs help find duplicated data and system boundaries [3]
Practitioners use them to find missing requirements and redundant flows [10, 11]
No gap
Maintenance
Part of system documentation [3]
Often drawn once and left to go stale [16]
Under-used
Who asks for it
A business analysis technique [1]
Job ads split between BA and architect roles [9]; security teams use DFDs for threat modeling [14]
Added by employers
Notation
Several notations in use [5, 6]
Tools give the same circle style different author labels [5, 6]
No gap
For the exam, learn the four elements, the connection rules and what a DFD cannot show. For the job, start with a context diagram, go deeper only where data problems hide, and keep the diagram current or retire it.
What are the four elements of a data flow diagram?
The four elements are externals, processes, data stores and data flows. Externals produce or receive data, processes transform it, data stores hold it, and data flows move it. Every flow must connect to at least one process.
What is the difference between a context diagram and a level 1 DFD?
A context diagram shows the whole system as a single process with its externals and the data they exchange, and it has no data stores. A level 1 DFD opens that single process into major sub-processes and shows the data stores between them. The two must balance: the same flows enter and leave.
What is the difference between Yourdon and Gane-Sarson notation?
Only the shapes differ. Yourdon-style diagrams draw processes as circles and data stores as two parallel lines, while Gane and Sarson draw processes as rounded rectangles and data stores as open-ended rectangles. The meaning and the rules are the same in both.
Is a data flow diagram the same as a process model?
No. A DFD shows how data moves and changes between processes, stores and externals, with no timing or decisions. A process model shows the order of activities, who does them and which path is taken at each decision.
Are data flow diagrams still used today?
Yes, but less by name. A UK job-ad tracker found 24 permanent IT ads citing them in the six months to October 2026, mostly for business analyst and architect roles. Security teams also draw DFDs for threat modeling.
