Data Inventory and Mapping

A personal data processing inventory is the core compliance document showing which personal data your company processes, for what purpose and on which legal basis, to whom it is transferred and how long it is kept. We build your inventory from scratch together with your departments, or update your existing inventory to reflect how you work today. We also map your data flows, making visible which data sits in which system and where it goes.

What is a personal data processing inventory?

A personal data processing inventory is a record of the processing activities a data controller carries out in its business processes. It links each activity to its purpose, legal basis, data category, group of data subjects and group of recipients. It also sets out maximum retention periods, data transferred abroad and the security measures taken. The inventory is defined in the Regulation on the Data Controllers’ Registry.

The inventory is the foundation for VERBİS registrations, privacy notices, the retention and destruction policy and cross-border transfer assessments. If a company’s inventory does not reflect reality, neither do these documents.

What is data mapping, and how does it differ from the inventory?

The inventory answers “which data, why and for how long” in table form. Data mapping shows the path data follows inside and outside the company: which form it enters through, which systems hold it (ERP, CRM, payroll, cloud services), which departments access it and which suppliers receive it. The map makes it possible to identify quickly which data is affected when a breach occurs. It also makes it easier to identify all transfers abroad.

Scope

Building the inventory from scratch or updating the existing inventory
Mapping processes and data flows department by department
Matching each processing activity with its purpose and legal basis
Setting retention periods
Aligning the VERBİS registration with the inventory

How We Work

Interviews with department heads and process questionnaires
Mapping the systems, suppliers and data flows in use
Preparing the inventory table: purpose, legal basis, data category, recipient, retention period, measures
Reporting processing without a legal basis, retention longer than necessary and similar risks
Delivering the inventory and agreeing how it will be kept up to date

Team

Ali Gül Founding Partner

Buse Yüceer Associate

Burcu Kulotu Associate

Frequently Asked Questions

Is a personal data processing inventory mandatory?

It is mandatory for data controllers required to register with VERBİS. There is no written obligation for those who are not. In practice, however, the duty to inform, identifying the legal basis and data security measures cannot be fulfilled without an inventory.

Are the inventory and the VERBİS registration the same thing?

No. The information notified to VERBİS is derived from the inventory. The inventory itself is far more detailed and is kept within the company.

How often should the inventory be updated?

The legislation sets no specific interval. It should be updated whenever a new process, system or supplier is added, and reviewed at least once a year.

Which departments take part in preparing the inventory?

Every department that handles personal data: usually human resources, sales and marketing, procurement, accounting, information technology and administrative affairs.

Would you like to discuss this service? Schedule a meeting with us — the first meeting is free of charge.

Schedule a meeting