Builds comprehensive data inventory per GDPR Art. 30 Records of Processing Activities. Covers system-by-system discovery, data flow diagramming, third-party identification, and legal basis per category. Keywords: data inventory, data mapping, Art 30, RoPA, data flow, processing activities.
Builds comprehensive data inventory per GDPR Art. 30 Records of Processing Activities. Covers system-by-system discovery, data flow diagramming, third-party identification, and legal basis per category. Keywords: data inventory, data mapping, Art 30, RoPA, data flow, processing activities.
A data inventory is the foundational artefact for privacy compliance, providing a structured catalogue of all personal data processing activities across the organisation. GDPR Article 30 mandates that controllers maintain Records of Processing Activities (RoPA) containing specific fields including categories of personal data, purposes of processing, categories of recipients, and transfers to third countries. This skill focuses on building the data inventory that feeds into the RoPA, with emphasis on system-by-system discovery, data flow mapping, classification linkage, and legal basis assignment per data category.
Art. 30 Required Content for Controllers — Art. 30(1)
Required Field
Description
Classification Relevance
(a) Controller identity
Name and contact details of controller, joint controller, representative, DPO
Administrative — not classification-dependent
(b) Purposes of processing
Specific purpose for each processing activity
Purpose determines applicable lawful basis and drives classification-to-handling mapping
(c) Categories of data subjects
Types of individuals whose data is processed (customers, employees, applicants)
Data subject category affects applicable protections (e.g., children, employees)
(d) Categories of personal data
Types of personal data processed per activity
Direct output of data classification — personal, special category, criminal
(e) Categories of recipients
Who receives the data, including processors
Determines transfer and sharing controls
(f) Transfers to third countries
International transfers and safeguard mechanisms
Triggers Chapter V compliance requirements
(g) Retention periods
Envisaged time limits for erasure of different categories
Classification tier drives retention policy
(h) Security measures
General description of Art. 32 technical and organisational measures
Classification tier determines security control level
Data Inventory Construction Methodology
Phase 1: System Discovery (Weeks 1-3)
Step 1: Enterprise Application Inventory
Build a complete list of systems that process personal data:
Vanguard Financial Services — System Inventory Example
System
Type
Department
Data Subjects
Classification Priority
Salesforce CRM
SaaS
Sales, Customer Service
Customers, prospects
Tier 1
Workday HR
SaaS
Human Resources
Employees, candidates
Tier 1
ADP GlobalView
SaaS
Payroll
Employees
Tier 1
Oracle Data Warehouse
On-premises
Data Engineering
All subjects
Tier 1
SharePoint Online
SaaS
All departments
All subjects
Tier 1
NICE Actimize
On-premises
Compliance
Customers, counterparties
Tier 1
HID Global Access
On-premises
Facilities
Employees, contractors
Tier 2
Cority Occ Health
SaaS
Occupational Health
Employees
Tier 2
Bloomberg Terminal
SaaS
Trading
Counterparties
Tier 2
Microsoft Teams
SaaS
All departments
Employees, external contacts
Tier 2
Adobe Analytics
SaaS
Marketing
Website visitors
Tier 2
ServiceNow ITSM
SaaS
IT
Employees
Tier 3
Confluence Wiki
SaaS
Engineering
Employees
Tier 3
Phase 2: Data Element Mapping (Weeks 3-6)
For each system, document every data element:
Step 2: Schema Extraction
Structured databases: Extract schema metadata (table names, column names, data types) via SQL metadata queries or data catalogue APIs
SaaS applications: Use API documentation to enumerate data objects and fields
Unstructured repositories: Catalogue document types and their typical personal data content
Automated discovery: Deploy scanning tools to identify PII in all repositories (see auto-data-discovery skill)
Step 3: Data Element Classification
For each data element, assign:
Personal data classification: PERSONAL_DIRECT, PERSONAL_INDIRECT, SPECIAL_CATEGORY, CRIMINAL_ART10, PSEUDONYMISED, ANONYMISED, NON_PERSONAL (see personal-data-test skill)
Classification tier: Public, Internal, Confidential, Restricted (see classification-policy skill)
Art. 6 lawful basis: The legal basis for processing this element for each stated purpose
Art. 9(2) condition: If special category, the specific processing condition
Phase 4: Legal Basis and Purpose Mapping (Weeks 9-11)
Step 6: Purpose-Basis Matrix
For each processing activity, map data categories to purposes and legal bases:
Processing Activity
Data Category
Purpose
Art. 6 Basis
Art. 9(2) / Art. 10
Customer account management
Name, email, address, account number
Contract performance
Art. 6(1)(b)
N/A
KYC identity verification
Name, DOB, ID documents, address
Legal obligation (MLR 2017)
Art. 6(1)(c)
N/A
Employee payroll
Name, NINO, bank details, salary
Contract performance
Art. 6(1)(b)
N/A
Employee diversity monitoring
Ethnicity, sexual orientation
Equality monitoring
Art. 6(1)(a) / 6(1)(c)
Art. 9(2)(a) / 9(2)(b)
Building access control
Fingerprint template
Physical security
Art. 6(1)(f)
Art. 9(2)(a)
AML monitoring
Transaction patterns, SAR data
Legal obligation (POCA 2002)
Art. 6(1)(c)
Art. 10 — DPA Sch.1 Pt.2 para 10
Website analytics
IP address, cookies, browsing
Legitimate interests
Art. 6(1)(f)
N/A
Marketing communications
Email, preferences
Consent
Art. 6(1)(a)
N/A
Phase 5: Documentation and Maintenance (Ongoing)
Step 7: Inventory Consolidation
Consolidate all discovery into the formal data inventory:
One record per data element per system
Cross-referenced to processing activities in the RoPA
Classification labels applied per element
Review dates set per classification tier
Step 8: Ongoing Maintenance
Maintenance Activity
Frequency
Responsible
Automated discovery scan reconciliation
Monthly
Privacy Engineering
New system onboarding inventory
Per new system deployment
System Owner + Privacy Analyst
Department data steward review
Quarterly
Data Stewards
Full inventory accuracy audit
Annually
DPO
Classification reclassification review
Annually (borderline: 6-monthly)
Privacy Analyst
Data Flow Diagram Standards
Notation Convention (Based on DFD Level 0/1)
Symbol
Meaning
Rectangle
External entity (data subject, third party, regulator)
Rounded rectangle
Process (system or application)
Open rectangle (two parallel lines)
Data store (database, file share)
Arrow
Data flow (labelled with data categories)
Dashed arrow
Optional or conditional data flow
Red border
Contains special category or criminal data
Blue border
International transfer
Enforcement Precedents
Österreichische Datenschutzbehörde (Austrian DPA) v Local Bakery Chain (2020): EUR 4,000 fine for failure to maintain Art. 30 records. The DPA noted that even small organisations must maintain processing records.
CNIL v Sergic (2019): EUR 400,000 fine, partly for inadequate data mapping — the controller could not demonstrate it knew where personal data was stored, leading to a data breach going undetected.
ICO v British Airways (2020): GBP 20 million fine, where inadequate data mapping contributed to delayed breach detection — the controller lacked visibility into personal data flows through its web infrastructure.
Integration Points
auto-data-discovery: Automated scanning feeds data elements into the inventory
personal-data-test: Classification decisions applied per data element in the inventory
special-category-data: Art. 9 data flagged and mapped to processing conditions
criminal-data-handling: Art. 10 data identified and mapped to national law authorisation
data-lineage-tracking: Lineage graphs extend the static inventory with dynamic flow information
