Personal data inventory

The personal data inventory records what personal data the organisation processes, why, on what legal basis, where it is kept, who receives it, whether it leaves India and how long it is kept. It is the foundation for the privacy notice, retention schedule, vendor register and cross-border transfer report, which are all written from it.

The inventory is available for clients in the sectors listed under Clients.

Three kinds of entry

• Activities: each use of personal data, such as account opening, payroll or CCTV. This is where most of the detail goes.
• Systems: the applications, databases, file stores and paper records that hold personal data, with where each is hosted.
• Recipients: the vendors, partners and authorities that receive personal data, with their role, location and, for vendors, contract details.

Starting from the sector list

A new inventory can start from a suggested list of the activities, systems and recipients typical of the client’s sector. Add it, then confirm, edit or delete each item: it is a starting point, not a finished record. Retention periods are left for you to set from the laws that apply.

Recording an activity

• Whose data and the personal data involved.
• Whether it includes children’s data, and how age is checked and parental consent obtained.
• Each purpose with its legal basis: consent, or a legitimate use under section 7 of the DPDP Act.
• Where the data goes: each system and recipient, the data each gets, and whether it leaves India. When it does, pick each country from the list and say why the data goes there.
• The retention period, when it starts, and its reason or legal source.
• The safeguards in place, and when the entry was last reviewed.

The percentage beside Data Inventory in the menu shows how many core fields are filled in across the activities.

Views and downloads

• Report and data map: every activity, system and recipient, and which data goes where. Print it or save it as a PDF.
• Retention schedule: each activity’s retention period, trigger and reason. It prints in landscape.
• Privacy notice: a plain-language notice for each group of people, written from the activities, with the contact details and settings you enter. The same inventory always gives the same notice; review it before publishing.
• Vendors: every recipient that provides a service, with what it gets, its contract and review dates, and anything that needs attention.
• Cross-border transfers: every place personal data leaves India, on a world map and grouped by country. Each card says where its countries come from, with links to fix anything missing.
• CSV downloads of the activities, systems, recipients, vendors and transfers.