Data Inventory
Roadmap:
Business Guide
[Link] | info@[Link]
DISCLAIMER: The materials available in this document are for informational purposes only and not for the purpose of providing legal advice. Red Clover Advisors, LLC is not a law firm,
and if you need legal advice, please contact a competent attorney to provide appropriate legal advice with respect to your specific concern.
Data Inventory
The Foundation for Privacy Compliance
Why Should I Maintain a Data Inventory?
In data protection laws around the world maintaining a data inventory is a legal obligation. In
our existing U.S. state consumer privacy laws, this obligation is not explicitly included, though
many requirements of these laws necessitate a comprehensive and up-to-date data inventory.
For example, under U.S. state privacy laws, organizations must notify consumers of the
purpose for processing their personal information. They must understand where they have
consent to process sensitive personal information. They must know where personal
information is stored to provide privacy rights to consumers.
Regardless of whether this obligation is written into a law, any company looking to have
responsible privacy practices should create and maintain some level of record-keeping around
how personal information flows through their organization. An accurate and comprehensive
data inventory is the foundation of a successful privacy program and will facilitate all
downstream privacy actions and decisions.
1 APPROPRIATE SAFEGUARDS
When you know what personal information you have and where you store it, you are
better able to protect it according to the risk it represents to the organization and
individuals.
2 PRIVACY NOTICE
The information you discover when conducting and maintaining your data inventory
will be the information to include in your privacy notice. Accurate and up-to-date data
inventories reduce regulatory risk by helping you ensure your privacy notice aligns
with your data handling practices.
3 PRIVACY RIGHTS COMPLIANCE
Complying with privacy rights such as access, deletion, correction and opt-out of certain
types of processing, requires a comprehensive understanding of your personal
information processing activities.
4 DATA MINIMIZATION
Many consumer privacy laws require that organizations only collect the minimum
amount of personal information necessary for the identified business purpose, and only
keep it as long as necessary for that purpose. Conducting a data inventory aids in
fulfilling this responsibility. Plus, by removing unnecessary data, you mitigate risks
associated with potential breaches.
[Link] | info@[Link]
1
DISCLAIMER: The materials available in this document are for informational purposes only and not for the purpose of providing legal advice. Red Clover Advisors, LLC is not a law firm,
and if you need legal advice, please contact a competent attorney to provide appropriate legal advice with respect to your specific concern.
Data Inventory
Mapping throughout the Data Lifecycle
Understanding how data moves through your organization involves investigating
activities at every aspect of the data lifecycle.
• What do we collect?
• How do we collect it?
COLLECTION • What is our business purpose for
collecting it?
• Do we obtain consent (if necessary)?
• How do we use it?
• Who has access to it and what
USE permissions do they have?
• Are we using it only for the
purposes we collected it for?
• What processors/vendors do we
share it with?
DISCLOSURE • What controllers/third parties do we
share it with?
• What affiliates do we share it with?
• Where do we store it (multiple
RETENTION databases?)?
• For how long do we store it?
• How do we protect it?
DELETION • How do we delete or destroy it?
• When do we delete or destroy it?
[Link] | info@[Link]
2
DISCLAIMER: The materials available in this document are for informational purposes only and not for the purpose of providing legal advice. Red Clover Advisors, LLC is not a law firm,
and if you need legal advice, please contact a competent attorney to provide appropriate legal advice with respect to your specific concern.
Maintenance Is the Key to Success
The initial data inventory process presents an opportunity to discover valuable insights about
how your organization handles personal information. You may learn that your company collects
more personal information than you realized and keeps it much longer than necessary. These
represent areas for improvement and, hopefully, surprises will be less frequent as your program
matures and privacy awareness builds.
Maintenance and upkeep of your data inventory is imperative. Your data inventory should
change as your business changes, as your website changes, and as your obligations change with
new laws and amendments. A privacy risk assessment program will help identify new elements
of personal information and new processing activities to include in your inventory. (See our
Privacy Risk Assessment Roadmap here.) And while this should help keep your inventory up to
date, it’s important to review and audit it regularly.
DATA INVENTORY CYCLE
Scoping Collection Points
Identify business activities 01 02 Take inventory of all the
processing personal points – online and off –
information, data subjects, where you collect personal
data elements, systems. information.
03 Internal Systems and
Document and Maintain
Cloud Storage
Log your findings in a data
Inventory all storage sites
inventory and establish a
and run a discovery
cadence for regularly 04 exercise to find personal
reviewing its accuracy.
information.
Interviews
Create a questionnaire that meets
your regulatory obligations and
interview representatives from
any team that interacts with
personal information.
[Link] | info@[Link]
3
DISCLAIMER: The materials available in this document are for informational purposes only and not for the purpose of providing legal advice. Red Clover Advisors, LLC is not a law firm,
and if you need legal advice, please contact a competent attorney to provide appropriate legal advice with respect to your specific concern.
DATA INVENTORY
Get Started!
Understanding your organization’s processing activities is central to data mapping.
A processing activity encompasses any operation involving personal information,
including collection, processing, storage, sharing, and deletion.
A good place to start is by breaking down the company into core
functions. Then, look at what happens within each function related to
personal data.
Marketing & Sales IT
• Email marketing • Business Continuity
• Targeted Ads • Cloud Services
• Digital Analytics • Disaster Recovery
• Sales • Asset Identification
Finance Product/Operations
• Accounts Payable • Account Setup
• Accounts Receivable • Order Processing
• Collections • New Products or Services
• Supply Chain Management
HR
• Payroll • Recruitment
• Benefits • Vacation
• Onboarding • Retirement
NOTE: This list contains examples, not inclusive of all functions or activities. There
are additional activities within each function and more functions overall, which
organizations can identify using the scoping phase of the data inventory cycle.
[Link] | info@[Link]
4
DISCLAIMER: The materials available in this document are for informational purposes only and not for the purpose of providing legal advice. Red Clover Advisors, LLC is not a law firm,
and if you need legal advice, please contact a competent attorney to provide appropriate legal advice with respect to your specific concern.
DATA
Data INVENTORY
Inventory: Key Benefits & Drivers
Data inventories inform other compliance, legal, privacy, risk, and information
security program initiatives.
REGULATORY PRIVACY RISK MANAGEMENT PRIVACY RIGHTS REQUESTS
Maintaining a record of Understanding where sensitive Data inventories support the
processing activities enables and high-risk data is collected efficient and timely response to
organizations to determine if and stored helps to ensure privacy rights requests by
data handling practices are proper protections are in place providing visibility into where
being managed in accordance and inform mitigation strategies personal information is stored
with applicable laws and to reduce privacy risk. and with whom it’s shared.
regulations.
THIRD-PARTY RISK
INCIDENT MANAGEMENT SECURITY MEASURES
MANAGEMENT
A centralized record of the Personal data inventories help Personal data inventories inform
individuals and entities with organizations identify the and support the required
which you have shared personal source of data incidents and operational and technical
security measures to ensure
information allows your understand the scope of the
personal information is
organization to better manage incident, informing your protected according to the risk it
third parties and the risks they response and recovery process. represents to individuals and the
present. organization.
When should a data inventory be created or updated?
Data inventories, processing activities, and business process owners should be
reviewed and updated periodically, at least annually, and when the organization
changes its handling of personal information.
New process, Change to an Using existing Sharing or selling Employing a new
product or system existing process personal personal data to a processor/ service
that is collecting, that collects, information in new controller / third provider that will
transmitting, transmits, ways. party. process personal
processing or processes or stores information.
storing personal personal
information information.
[Link] | info@[Link]
5
DISCLAIMER: The materials available in this document are for informational purposes only and not for the purpose of providing legal advice. Red Clover Advisors, LLC is not a law firm,
and if you need legal advice, please contact a competent attorney to provide appropriate legal advice with respect to your specific concern.
DATA INVENTORY
Set Yourself Up for Success
Prioritize Heavy Users Work Smarter Not Harder
Certain business units process personal While you will need to conduct interviews
information more than others and process and ask teams to fill out questionnaires,
it in ways that present greater risk to the take advantage of technologies like cookie
company and individuals. These are teams scanners, data discovery tools, data
like sales, marketing, finance, customer mapping tools and others to facilitate the
support and human resources. Prioritize inventory process.
your interview process to get to those
teams first to mitigate the most risk as
quickly as possible.
Think of This as an Opportunity Get Leadership Support
In the process of creating or maintaining Is your leadership team on board? Then
your data inventory, you will set up leverage that support! If not, begin your
meetings with other business units in your awareness campaign at the top. Doing
organization. Use this as an opportunity to privacy well takes effort from every
raise awareness about privacy and find out business unit in the company. When
who your potential privacy champions are leadership makes all employees aware that
that may help raise privacy concerns when this is a priority, teams will be more willing
the privacy team isn’t part of a discussion. to make time to talk about privacy.
[Link] | info@[Link]
6
DISCLAIMER: The materials available in this document are for informational purposes only and not for the purpose of providing legal advice. Red Clover Advisors, LLC is not a law firm,
and if you need legal advice, please contact a competent attorney to provide appropriate legal advice with respect to your specific concern.