How to Build a Personal-Data Inventory and Processing Register

A privacy programme begins with visibility

Personal data may sit in cloud platforms, spreadsheets, HR folders, email inboxes, CCTV systems, shared drives, mobile devices, paper files, website forms, and vendor systems. A personal-data inventory creates visibility. A processing register turns that visibility into an operational record.

Start with business processes, not systems

Begin with recruitment, employee management, payroll, sales, customer onboarding, marketing, complaints handling, vendor management, finance, physical security, website administration, and digital service delivery. For each process, identify the data used and the systems involved.

Minimum fields for your register

Identify sensitive and high-risk processing

Flag health data, biometric data, financial information, children’s data, national identity information, employee performance records, and large-scale behavioural or location data. Also flag processing involving new technology, automated decision-making, surveillance, profiling, or international cloud platforms.

Map the data flow

For each key process, map collection, use, storage, access, sharing, retention, and deletion. A simple example is: website form → CRM → sales team → email platform → cloud backup → deletion schedule.

Include vendors

Record cloud hosting providers, HR and payroll platforms, CRM systems, marketing platforms, payment providers, managed service providers, call-centre vendors, software-development partners, and security monitoring providers. Document what data is involved, the service purpose, known hosting locations, contract status, and review outcome.

Keep the register alive

Update it when a new system goes live, a vendor changes, a campaign starts, a business process changes, an incident is identified, or a retention rule changes. Start with high-value and high-risk processes, then expand over time.