Data Inventory and Mapping for Classification

Overview

A data inventory is the foundational artefact for privacy compliance, providing a structured catalogue of all personal data processing activities across the organisation. GDPR Article 30 mandates that controllers maintain Records of Processing Activities (RoPA) containing specific fields including categories of personal data, purposes of processing, categories of recipients, and transfers to third countries. This skill focuses on building the data inventory that feeds into the RoPA, with emphasis on system-by-system discovery, data flow mapping, classification linkage, and legal basis assignment per data category.

Art. 30 Required Content for Controllers — Art. 30(1)

Required Field	Description	Classification Relevance
(a) Controller identity	Name and contact details of controller, joint controller, representative, DPO	Administrative — not classification-dependent
(b) Purposes of processing	Specific purpose for each processing activity	Purpose determines applicable lawful basis and drives classification-to-handling mapping
(c) Categories of data subjects	Types of individuals whose data is processed (customers, employees, applicants)	Data subject category affects applicable protections (e.g., children, employees)
(d) Categories of personal data	Types of personal data processed per activity	Direct output of data classification — personal, special category, criminal
(e) Categories of recipients	Who receives the data, including processors	Determines transfer and sharing controls
(f) Transfers to third countries	International transfers and safeguard mechanisms	Triggers Chapter V compliance requirements
(g) Retention periods	Envisaged time limits for erasure of different categories	Classification tier drives retention policy
(h) Security measures	General description of Art. 32 technical and organisational measures	Classification tier determines security control level

data-inventory-mapping

Data Inventory and Mapping for Classification

Overview

Art. 30 Required Content for Controllers — Art. 30(1)