What Is a Data Inventory?
PracticeA data inventory is a record of every place personal data lives in your organisation: which systems hold it, what categories of data each holds, the purpose it's held for, who can access it, and how long it's kept. It's the single most useful artefact a compliance programme can have, because nearly every other chapter in this guide assumes it exists — you can't answer a Section 11 access request, apply a Section 12 erasure request, scope a breach under Chapter 10, or set a defensible retention schedule under Chapter 08 without first knowing where the data actually is.
What Is Data Mapping?
Data mapping extends the inventory from a static list into a picture of movement — how data flows from the point it's collected (a signup form, a mobile app, a call centre) through the systems that touch it, to wherever it ultimately ends up, including any third parties it's shared with. Where an inventory answers "what do we hold," a map answers "how did it get here, and where does it go next."
Data Discovery
PracticeBuilding an inventory usually starts with discovery — systematically finding every system, spreadsheet, and third-party tool that touches personal data, rather than relying on what's already documented (which is almost always incomplete). Interviewing each team about the tools they actually use day to day tends to surface far more than reviewing IT's official system list alone — shadow IT and one-off spreadsheets are where a surprising amount of personal data quietly accumulates.
Data Flow Mapping
For each significant data category, map: where it's collected, every system it's stored or processed in, who or what has access at each point, and every third party it's shared with and why. A simple flow diagram per major data category (customer data, employee data, marketing leads) is usually more useful day-to-day than one enormous, unreadable master diagram covering everything at once.
Data Sources and Systems
| Category | Typical sources |
|---|---|
| Customer data | Website forms, checkout, CRM, support tickets, mobile app |
| Employee data | HRMS, payroll, attendance systems, benefits platforms |
| Marketing data | Email platform, ad-tech pixels, analytics tools, lead-gen forms |
| Vendor-held data | Cloud hosting, payment processors, analytics providers, SaaS tools |
Third-Party Data Flows
PracticeThis is the part most inventories miss initially. Data shared with a payment gateway, an email service provider, an analytics tool, or a customer-support platform hasn't left your responsibility — under Section 8(1), you remain accountable for it. A complete inventory tracks not just your own systems but every vendor those systems hand data to, which connects directly to the due-diligence work covered in Chapter 12.
Building an inventory that covers internal systems thoroughly but stops at the boundary of the organisation — leaving every third-party tool and vendor integration undocumented. A breach or rights request that touches vendor-held data is just as much your responsibility as one that touches your own database.
Building a Data Inventory
- Interview each team about the tools and systems they actually use, not just the official IT asset list.
- For each system, record: data categories held, purpose, access list, retention period, and any third parties it shares data with.
- Classify each data category by sensitivity (Chapter 02) to prioritise where security effort goes first.
- Assign a single owner responsible for keeping the inventory current — not a project team that disbands once the first version is done.
Maintaining the Inventory
PracticeAn inventory is only useful while it's accurate, and it decays the moment a new tool is adopted or a data field is added to a form without anyone updating the record. Building a lightweight review step into your existing process for adopting new tools or launching new features — even a single question on a procurement or product-launch checklist ("does this touch personal data, and has the inventory been updated?") — does more for long-term accuracy than an annual full re-audit alone.