Record Keeping

• Author: David Zetoony
• Profession: Is a partner in the Boulder, Colorado office of Bryan Cave Leighton Paisner, LLP, an international law firm
• Pages: 75-79

75

RecoRD KeepInG

Q.77 ARe contRoLLeRs ReQUIReD to Do

A “DAtA InVentoRy”?

The term data inventory is not used within the GDPR, and as such, con-

ducting a data inventory is not explicitly required.

What is required under Article 30 of the GDPR is that most

companies “maintain a record” of their processing activities. For con-

trollers, that record must include the following specic components for

each piece of personal data processed:

• An explanation concerning the purpose of the processing;

• A description of the categories of data subjects involved;

• A description of the categories of personal data involved;

• A description of the categories of recipients who receive the data;

• A description of the countries outside of the European Economic

Area (if any) where the data is sent and the adequacy measures dis-

cussed in Q 116 used to facilitate the transfer;

• The time period before which the data is anticipated to be erased; and

• A description of the security applied to the data.167

The type of record that companies decide to create to satisfy the require-

ments imposed by Article 30 vary dramatically. Many companies choose

to create a centralized list or “data inventory” of each eld of personal data

that they collect and to list each of the required pieces of information next to

the eld. Other companies keep separate documents for each data system in

their possession. These fact sheets are sometimes referred to as data registers.

Still other companies choose to graphically depict the required information

in order to illustrate the recipients of the data, the locations where the data

is kept, and the countries to which it ows. These graphical depictions are

sometimes referred to as “data maps” or “data ow diagrams.”

167. GDPR, Article 30(1)(b)–(g).