Knowledge base

How to build a data inventory

The foundation of compliance work. Without a correctly built inventory, the policy, the disposal and the request response all hang in the air.

When to use it: When starting KVKK compliance, during an ISO 27701 implementation, and before an audit.

Steps

01
List the units
Write down every unit that touches personal data: HR, finance, sales, marketing, IT, field operations. Skip none; the most unexpected data turns up in the most unexpected place.
02
Sit down with each unit for half an hour
The question is: in your daily work, which information about people do you touch, where does it come from, where do you keep it, who do you send it to. Avoid jargon; let them describe the process.
03
Scan the systems separately too
There are always systems nobody mentions: an old shared folder, a form tool, a backup. Compare against IT's system inventory.
04
Write a purpose and legal ground for every row
Why do we process this data and which article of the Law do we rely on. If no purpose can be written, that data is probably being collected unnecessarily.
05
Mark the transfers
If data leaves the organisation: to whom, for what purpose, under which contract. Cloud providers and outsourced services belong here.
06
Add the retention period and its basis
How long we keep it and why. "It might be needed" is not a basis; there must be a statute, a limitation period or a defined business reason.
07
Assign an owner for updates
The inventory is not a one-off task. When a new system or process arrives, it must be clear who updates it.

Trying to be perfect on the first pass — an incomplete inventory beats no inventory.
Talking only to IT; the units that actually use the data get skipped.
Producing the table and never opening it again; six months later it is stale.

The guides describe general practice and are not legal advice. Refer to the official source for the current text of the legislation.

The free initial assessment maps your current state and tells you which step should come first. You are not committed to anything afterwards.

Look at it yourself first

A twenty-five question KVKK compliance test with per-area scores and a priority recommendation. No sign-up.

Let's look together

We discuss your current state and work out which step comes first and how long it takes.