Data Inventory and Mapping for Classification

Data Inventory and Mapping for Classification

Overview

A data inventory is the foundational artefact for privacy compliance, providing a structured catalogue of all personal data processing activities across the organisation. GDPR Article 30 mandates that controllers maintain Records of Processing Activities (RoPA) containing specific fields including categories of personal data, purposes of processing, categories of recipients, and transfers to third countries. This skill focuses on building the data inventory that feeds into the RoPA, with emphasis on system-by-system discovery, data flow mapping, classification linkage, and legal basis assignment per data category.

Art. 30 Required Content for Controllers — Art. 30(1)

Data Inventory Construction Methodology

Phase 1: System Discovery (Weeks 1-3)

Step 1: Enterprise Application Inventory

Build a complete list of systems that process personal data:

Vanguard Financial Services — System Inventory Example

Phase 2: Data Element Mapping (Weeks 3-6)

For each system, document every data element:

Step 2: Schema Extraction

• Structured databases: Extract schema metadata (table names, column names, data types) via SQL metadata queries or data catalogue APIs
• SaaS applications: Use API documentation to enumerate data objects and fields
• Unstructured repositories: Catalogue document types and their typical personal data content
• Automated discovery: Deploy scanning tools to identify PII in all repositories (see auto-data-discovery skill)

Step 3: Data Element Classification

For each data element, assign:

• Personal data classification: PERSONAL_DIRECT, PERSONAL_INDIRECT, SPECIAL_CATEGORY, CRIMINAL_ART10, PSEUDONYMISED, ANONYMISED, NON_PERSONAL (see personal-data-test skill)
• Classification tier: Public, Internal, Confidential, Restricted (see classification-policy skill)
• Art. 6 lawful basis: The legal basis for processing this element for each stated purpose
• Art. 9(2) condition: If special category, the specific processing condition

Phase 3: Data Flow Mapping (Weeks 6-9)

Step 4: Intra-System Data Flows

Document how data moves within the organisation:

Customer Onboarding Data Flow — Vanguard Financial Services

Customer ──[web form]──► Salesforce CRM
                              │
                    ┌─────────┼──────────┐
                    ▼         ▼          ▼
              Oracle DW   SharePoint   Email (welcome)
              (analytics) (documents)  (notifications)
                    │
                    ▼
              Adobe Analytics
              (web behaviour)

Step 5: External Data Flows (Third-Party Sharing)

Document all data sharing with external parties:

Phase 4: Legal Basis and Purpose Mapping (Weeks 9-11)

Step 6: Purpose-Basis Matrix

For each processing activity, map data categories to purposes and legal bases:

Phase 5: Documentation and Maintenance (Ongoing)

Step 7: Inventory Consolidation

Consolidate all discovery into the formal data inventory:

• One record per data element per system
• Cross-referenced to processing activities in the RoPA
• Classification labels applied per element
• Review dates set per classification tier

Step 8: Ongoing Maintenance

Data Flow Diagram Standards

Notation Convention (Based on DFD Level 0/1)

Enforcement Precedents

• Österreichische Datenschutzbehörde (Austrian DPA) v Local Bakery Chain (2020): EUR 4,000 fine for failure to maintain Art. 30 records. The DPA noted that even small organisations must maintain processing records.
• CNIL v Sergic (2019): EUR 400,000 fine, partly for inadequate data mapping — the controller could not demonstrate it knew where personal data was stored, leading to a data breach going undetected.
• ICO v British Airways (2020): GBP 20 million fine, where inadequate data mapping contributed to delayed breach detection — the controller lacked visibility into personal data flows through its web infrastructure.

Integration Points

• auto-data-discovery: Automated scanning feeds data elements into the inventory
• personal-data-test: Classification decisions applied per data element in the inventory
• special-category-data: Art. 9 data flagged and mapped to processing conditions
• criminal-data-handling: Art. 10 data identified and mapped to national law authorisation
• data-lineage-tracking: Lineage graphs extend the static inventory with dynamic flow information