A data inventory a small team will actually maintain

A data inventory can fail by being too ambitious. Imagine a team creating a spreadsheet with dozens of columns, filling half of them once and never opening it again. Meanwhile, a new booking tool and several shared exports appear outside its map.

Start with a shorter record that helps answer ordinary questions: why do we have this information, where does it go, who can change the process and what should happen when the purpose ends?

Use a workflow as the unit of work

Choose a process people recognise, such as an order, appointment, enquiry or staff onboarding. Follow one synthetic example from collection through its ordinary handoffs. Include the spreadsheet someone downloads and the message a contractor receives, not just the official application.

Record the categories of information, source, purpose, relevant processing route, systems, recipients, access owner and retention decision. If one row becomes too broad to explain, split it by activity. If several rows describe the same unchanging handoff, avoid duplicating them unnecessarily.

An inventory is a practical control, not a claim that DPDP prescribes this exact spreadsheet for every business. As of 22 October 2026, the relevant substantive duties are scheduled for 13 May 2027 under the commencement notification. The future section 8 accountability and organisational-measures framework gives the record a useful purpose: helping the team understand and operate the responsibilities it will need to meet.

Distinguish a system from a purpose

One customer-management tool can support enquiries, service delivery and promotions. Those uses may have different explanations, access and retention decisions. A row saying ‘CRM: customer data’ hides those differences.

Likewise, the same purpose can cross several systems. A withdrawal recorded in one place may need to affect a campaign export elsewhere. The inventory should show that relationship, with a responsible person for the handoff.

Use the section 2(i) and 2(k) role distinctions when identifying external parties. A supplier’s own purposes may differ from processing performed on your behalf. Record uncertainty as a question to resolve, rather than forcing every vendor into one label.

A hypothetical print-shop inventory

A print shop starts with customer orders. It maps the enquiry form, the artwork folder, the production queue, the delivery instruction and the invoice record. The exercise reveals that customers sometimes upload documents containing other people’s information and that completed artwork remains in an unrestricted shared folder.

The owner does not add twenty new columns. The team adds a handling instruction for unexpected personal content, narrows access to active production files and records the review event for completed work. It separately assesses the records needed for invoicing and other applicable obligations.

The map also names the person who can change the upload form and the person who can close a completed job. That makes the inventory useful when a customer asks a question or an employee notices an unnecessary copy.

Record a retention decision, not a slogan

For each category, identify the event, purpose or obligation that governs retention and the person responsible for applying it. Under the future section 8(7), erasure must be read with legal retention, including rule 8(3) and the Seventh Schedule. Do not write ‘delete on request’ without those qualifications or ‘keep indefinitely’ without a defensible reason.

You may not resolve every period in the first session. Record the open question, temporary handling restriction and owner. An honest unresolved entry is more useful than a guessed number that later becomes an automated rule.

Tie updates to existing decisions

Add an inventory check when the business introduces a new tool, field, recipient, integration or purpose. Keep the check short: what changed in the data path, which decision needs review and who will update the record?

Use a periodic sample to compare the inventory with reality. Ask an employee to demonstrate one ordinary task and inspect the relevant output. The future rule 6 safeguards will be easier to assess when the map includes actual access and copies.

Keep the record readable

Use familiar process names, short field descriptions and links to supporting evidence. Avoid storing raw customer examples in the inventory itself. Restrict any sensitive architecture or access details appropriately while keeping the operational summary available to the people who maintain it.

Counting completed rows does not tell you whether the inventory helps the team. A useful inventory helps someone make a decision about a real record or workflow. Keep it small enough to maintain and specific enough to show what changes when the business changes.