Chapter 2 of 11 · 4 checks · 2 min
Inventory and data mapping
You cannot protect, delete or report on data you do not know you have. These checks follow the Inventory and Mapping category of the NIST Privacy Framework.
Keep an inventory of every system and dataset that holds personal dataMust
Why it matters and how to check
The NIST Privacy Framework starts its Identify-P function with inventory: systems, products and services that process data are inventoried, along with their owners or operators and their roles. Personal data spreads into places people forget: analytics warehouses, spreadsheets, BI extracts, search indexes, caches, backups, test databases and notebooks.
To verify, compare the inventory with reality. List your databases, buckets, warehouse schemas and third-party tools, and check each one either appears in the inventory with an owner or is confirmed to hold no personal data.
Map how personal data flows between systems, teams, vendors and countriesShould
Why it matters and how to check
The NIST Privacy Framework asks organisations to map data processing, showing the data actions and data elements for each system, and to identify the processing environment, such as geographic location, internal systems, cloud and third parties. A map shows where a deletion request has to reach and where a transfer happens.
To verify, take one common personal field, such as email address, and trace it from collection to every place it is copied, joined, exported or sent. Check each hop appears on the data map, including vendors and the regions where data is stored.
Support your organisation's records of processing with accurate technical detailShould
Why it matters and how to check
Article 30 of the GDPR requires controllers and processors to keep records of processing activities, including purposes, categories of data and recipients, transfers to other countries, retention periods where possible, and a general description of security measures. Privacy teams write these, but they depend on engineers for the facts.
To verify, ask your privacy lead for the record covering your system and check it against the actual schema, vendors, regions and retention settings. Report any differences.
Update the inventory when schemas, pipelines or vendors changeShould
Why it matters and how to check
An inventory that is right on the day it is written is wrong a month later. The cheapest way to keep it current is to make it part of normal change review: a new column holding personal data, a new export or a new vendor triggers an update.
To verify, look at the pull request template or design review checklist. It should ask whether the change adds, moves or shares personal data, and the last few changes that did so should have a matching inventory update.