Personal data inventory: the document nobody wants to write

The personal data processing inventory (the ROPA, in GDPR vocabulary) has a well-deserved bad reputation. In most companies it is born as a giant spreadsheet, filled in during an all-hands scramble, and goes stale within three months.

The problem is not the document. It is the order in which it is usually done.

Start with the process, not the system

The temptation is to list systems and catalog fields. That produces an inventory that is technically correct and useless for decisions: nobody can say, looking at a list of tables, whether that processing has a legal basis.

Start with the business processes that handle people's data: hiring, selling, serving, terminating, billing. There are few of them, they have a clear owner, and each one answers why it processes the data.

The seven questions per process

For each process, answer in one line:

• What purpose justifies the processing
• Which categories of data are processed, and whether there is sensitive data
• Whose data it is: customer, employee, candidate, third party
• Which legal basis supports the purpose
• Who the data is shared with, inside and outside the company
• How long it is kept, and what happens afterward
• Where it resides, including international transfer

Seven short answers are worth more than seventy half-filled fields.

Legal basis is a decision, not a box to fill in

The most common mistake is to check "consent" for everything. Consent is the most fragile basis: it can be revoked, it requires proof that it was freely given and informed, and it doesn't work for what the company would do anyway.

Payroll doesn't depend on consent; it depends on a legal obligation. Delivering an order rests on performance of the contract. Fraud prevention usually falls under legitimate interest, and there the proportionality test has to be written down, not presumed.

Choosing the wrong basis is not a formal detail: it changes the right the data subject can exercise and the defense the company will have.

Retention is where the inventory becomes useful

Almost every company keeps more than it needs and for longer than it can justify. Defining the period by purpose is the item in the inventory that generates the most immediate value: it reduces risk surface, storage cost and the scope of an incident.

Beware of the period inherited from another area. "We keep it five years because tax requires it" may hold for the invoice, not for the browsing history attached to it.

And a period without a deletion routine is an intention. If nobody deletes, the written period only documents the breach.

Keep it alive with a trigger, not a calendar

An annual review is the shortest path to an obsolete document. What keeps an inventory up to date is a process trigger: a new system, a new vendor, a new purpose or a change of scope require updating it before going into production.

Tying it to the flow that already exists (contract approval, project kickoff) costs less than creating a ritual of its own.

The right size

A good inventory fits in a few pages per area and is read by the people who decide. If yours has three hundred lines and only the data protection officer (DPO) understands it, it won't survive the first change of manager.

Start with the three processes that handle the most sensitive data. Publish it. Then expand. A partial, living inventory protects more than a complete, dead one.