Inventorying

Maturity Level

Privacy Logo

  1. Level 0: Non-Existent

    The practice is not implemented or acknowledged.
    No inventory of IT systems that process data, data processing activities, authorized purposes for processing, necessity for the processing, the personal data in a particular record series, non-compliant processing activities and strategies to bring them into compliance, exists.

    Example Strategies

    • Identify individuals within the entity who have familiarity of knowledge of the IT systems and data processing who can begin an initial inventorying process until permanent individuals to perform inventorying are established.

  2. Level 1: Ad Hoc

    Practice may occur but is undocumented (no policies or procedures), application is reactive and not standardized.
    Some departments might maintain informal lists of systems or data they use, but there's no centralized or standardized inventory.

    Example Strategies

    • Compile a preliminary list of major data-processing systems.

  3. Level 2: Defined

    Practice is implemented and documented, but documentation may not cover all relevant aspects, and application may be informal and inconsistent.
    A basic inventory of IT systems is developed, but it may lack detailed information about the personal data processed within each system or data flows.

    Example Strategies

    • Maintain a formal inventory of all IT systems and processing activities.

  4. Level 3: Consistently Implemented

    Practice is documented to cover all relevant aspects, application is formal and consistent.
    A comprehensive and regularly updated inventory of all systems and applications that process personal data is maintained, linked to record series annotations and demonstrating data flows.

    Example Strategies

    • Reconcile the inventory against "Shadow IT" using discovery tools.

  5. Level 4: Managed

    Practice is actively managed with metrics that are regularly reviewed to assess efficacy and facilitate improvement.
    The entity uses the data inventory to identify privacy risks, track data types and volumes, and measure compliance with data minimization principles.

    Example Strategies

    • Implement a "Live Inventory" that updates via API integration.

  6. Level 5: Optimized

    Practice is fully embedded in the entity with recognition and understanding across the workforce through active training and awareness campaigns, and inclusion in operations and strategy.
    The data inventory is dynamic and automated, providing real-time insights into data holdings and supporting advanced analytics for privacy risk management and data governance.