Data Inventory
The authoritative list of personal data an organisation holds, together with where it lives, who owns it, and under what lawful basis it is processed.
Full Definition
A data inventory is a subset of the data catalog: specifically the personal-data assets, keyed to the Record of Processing Activities. For each asset it records the data categories (PII, sensitive PII, children's data, financial), the collection source, the storage location, the data owner, the retention period, the lawful basis, the recipients and the cross-border transfer destination. GDPR Article 30, DPDP Rule 11 and PDPA's Accountability Obligation all require such an inventory for in-scope processing.
In practice the inventory is produced through a combination of automated discovery (scanning structured and unstructured sources for personal data) and documented front-of-collection decisions (every new processing activity gets inventoried at the design stage). The inventory feeds the DSR fulfilment pipeline (which systems to query for a subject's data), the breach workflow (which categories are in scope for a given incident), and the retention automation (which assets to erase on schedule).
Related terms
Data Catalog
A centralised, searchable inventory of an organisation's data assets with metadata about location, schema, owner, classification and lineage.
RoPA
Record of Processing Activities — a mandatory inventory of all personal data processing activities under GDPR Article 30.
Data Classification
The process of labelling each data asset with its sensitivity, regulatory category and handling requirements.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes