GDPR
GDPR in a company: where should a data inventory begin?
Choose one activity, such as handling customer enquiries, and describe the data it uses. Identify the purpose, access and storage arrangements. This factual picture supports a useful review of both documents and processes.
Prepared and sources reviewed:
Reviewed by Skirmantas Šmuilys, head of MB Opus Justitia, on .
One clear entry for each activity
In a working table, record where data comes from, the fields collected, why they are needed and the systems holding them. If an answer is unknown, note a question for the responsible person. This is a preparation tool, not automatically a completed compliance record.
Questions for the person who knows the process
- What legal basis is relied on, and are special categories of data processed?
- Who can actually see the data, and who receives it?
- Are external service providers involved, and where are copies stored?
- When is data reviewed, deleted or moved to an archive?
- What information are people given about the use of their data?
Compare practice with the documents
Place existing privacy notices and service provider agreements alongside the table. Mark differences between the described and actual process. The EDPB’s explanation of basic principles helps frame questions about purpose, data volume, storage and security.
Questions and answers
Where should we start if we have no list of data processes?
Choose one process and describe its data, systems and responsible people. Expand this initial list as you review further processes.
Do you need our customer database for a consultation?
An initial discussion of processes generally needs a description of data fields and how they are used, rather than real customer records. If examples are needed, we will agree a safe way to provide them.
Official sources
This is general preparation information, not individual legal advice. Specific action and current rules must be assessed against your circumstances.