Governance · Privacy and data governance · 01
Data inventory and mapping
Data inventory and mapping establishes what personal and sensitive data the organization holds, where it comes from, where it is stored, who can access it, where it is sent, how long it is kept and under what legal basis. It is needed when a privacy program is being built or audited, when a regulation such as HIPAA, GDPR or CCPA requires records of processing, when a data subject request cannot be answered because nobody knows where the data is, or when an incident revealed data in places it should not have been. The mapping produces a data inventory by category and system, data flow maps across systems and vendors, the legal basis and retention for each flow, and the register that every other privacy control depends on.
Scope
What the review covers.
- Discovery across applications, databases, file stores, collaboration tools and vendors
- Data categories, sensitivity and the individuals they concern
- Flows: collection, storage, access, transfer, deletion
- Legal basis, purpose and retention per flow
- Vendor and cross-border transfer identification
- Register design and maintenance
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Data inventory | Categories, systems, owners, sensitivity |
| Data flow maps | Across systems and vendors |
| Records of processing | Purpose, basis, retention, recipients |
| Maintenance procedure | How changes enter the register |
Prerequisites
What we need from you.
- Access to system owners and administrators for discovery
- Vendor contracts and data processing agreements
- The regulations that apply to the organization’s data
Related
Where this sits.
- Privacy and data governance Service
- Governance Hub
- HIPAA readiness Also
- GDPR and CCPA readiness Also
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
How is this different from data classification under security?
Classification rates sensitivity to drive access controls. The privacy inventory records purposes, bases, flows and retention as regulation requires. They share the discovery.
Do you use discovery tools?
Where the environment justifies them. Interviews and system review find most data; tools confirm and find the rest.
How often does the inventory need updating?
Whenever a system, vendor or purpose changes. The maintenance procedure ties updates to those events.