What it means
A data processing inventory records how personal data is collected, used, stored, shared, retained, protected, and governed across business activities and systems.
Why it matters
A simple system list cannot answer why data exists, who uses it, what rights apply, where it moves, or which controls and contracts govern it.
Practical focus
- Define inventory fields for activity, purpose, people, data categories, sources, systems, recipients, locations, retention, legal basis, owner, and risk.
- Reconcile records with architecture, discovery, vendor, product, data-catalog, and rights systems rather than relying on questionnaires alone.
- Create ownership, attestation, change triggers, quality rules, and exception handling that keep the inventory operationally current.
- Preserve this evidence: Retain inventory records, owner attestations, discovery comparisons, change history, unresolved discrepancies, and evidence supporting key fields.
- Exercise this failure scenario: An incident or rights request reveals an unrecorded dataset because the inventory was updated only during an annual spreadsheet exercise.
Common mistakes
- Using the label Data Processing Inventory without defining scope, ownership, decision authority, and the exact data, systems, people, or process affected.
- Treating a policy, contract, diagram, dashboard, or tool demonstration as proof that Data Processing Inventory operates consistently in production.
- Closing work without retaining the evidence needed to reconstruct the decision and verify the intended control outcome.
- Testing only the normal path and never rehearsing the failure condition: An incident or rights request reveals an unrecorded dataset because the inventory was updated only during an annual spreadsheet exercise.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: