I didn't use to take into account data movements until in a project we found sensitive data scattered all over the data flow, but the problem is that we were not clear about the flow itself, so it was very difficult to trace where this uncontrolled information could be