Chapter 4 — A data inventory | Professional Data governance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — A data inventory

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Building the inventory"]
  N2["4.2 Surprises"]
  N3["4.3 Finding gaps"]
  N4["4.4 Keeping it current"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Building the inventory"]
  N2["4.2 Surprises"]
  N3["4.3 Finding gaps"]
  N4["4.4 Keeping it current"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX016"]

[Learning outcomes]
    |
    v
[4.1 Building the inventory]
    |
    v
[4.2 Surprises]
    |
    v
[4.3 Finding gaps]
    |
    v
[4.4 Keeping it current]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) build a data inventory; (2) record purpose, location and access; (3) use the inventory to find gaps.

4.1 Building the inventory

Grace builds an inventory in a spreadsheet. Each row is a set of data, such as donor database or referral forms at the riverside food bank. Columns record what personal data it holds, purpose, lawful basis, where it is stored, who can access it, how long it is kept and the owner. She visits each food bank and asks leads to show her where data are kept, rather than relying on descriptions, and finds items nobody had mentioned. She visits all six food banks in two weeks.

4.2 Surprises

At two food banks, volunteers keep client phone numbers on personal phones to arrange collections. One food bank keeps referral forms from five years ago in a cupboard. The shared inbox contains referral emails from social workers with full case details. Grace records each in the inventory. Mr. Nowak notes that visiting in person reveals informal practices that people do not think to mention because they seem normal to them. Grace thanks the leads for showing her these practices openly and explains that the aim is to fix problems, not to blame anyone.

4.3 Finding gaps

With the inventory complete, Grace looks for gaps: data without a clear purpose, data without a lawful basis recorded, data kept too long and data accessible to too many people. She finds that the five-year-old forms have no purpose now, that volunteers' personal phones are uncontrolled and that the shared inbox is open to all staff. She lists actions with owners and dates for each gap. The trustee overseeing data reviews the action list and agrees the dates with each owner, so that the most serious gaps, involving client data, are addressed first.

4.4 Keeping it current

Grace asks owners to tell her when they start collecting new data or change how they store it. She schedules a review of the inventory every six months. She also uses the inventory to write Northbank's privacy notice, because it lists what data are held and why. Mr. Nowak explains that the GDPR expects organisations to keep records of processing, and that a good inventory serves this purpose and many others. Grace adds the inventory review to the governance calendar so that it is not forgotten during busy periods.

Worked example

Grace builds an inventory by visiting each food bank, finds client numbers on personal phones, five-year-old forms and an open inbox, lists actions for gaps and keeps the inventory current for the privacy notice.

Synthetic case. Findings are synthetic; the GDPR is real.

Errors and limits

Building inventories from descriptions alone misses informal practices.

Exercises

EX016 — Visiting reason. Why did Grace visit food banks in person? Rubric: 3 = to find data people do not mention;; 2 = partly correct;; 1 = vague;; 0 = none.
EX017 — Old forms. How old were the forgotten referral forms? Rubric: 3 = five years;; 2 = partly correct;; 1 = wrong;; 0 = none.
EX018 — Inbox gap. What was wrong with the shared inbox? Rubric: 3 = open to all staff with case details;; 2 = partly correct;; 1 = vague;; 0 = none.
EX019 — Review cycle. How often is the inventory reviewed? Rubric: 3 = every six months;; 2 = partly correct;; 1 = wrong;; 0 = none.
EX020 — Notice use. What document does the inventory help write? Rubric: 3 = the privacy notice;; 2 = partly correct;; 1 = other;; 0 = none.

Continue studying — lesson 04 (chapter 04 of 12)

← Chapter 03 · Course chapter index · Chapter 05 →

Continue to the next authored lesson.