Service

Personal Data Inventory

Map where personal information enters the business, where it goes, and who is responsible before privacy obligations or customer questions catch you out.

Usually starts in Baseline

Book a Free Consultation Take the 2-Minute Security Scorecard

Typical deliverable

Personal Data Inventory

Full register of all personal data holdings with collection purpose, legal basis, retention period, access controls, and system locations.

Personal Data Inventory

Full register of all personal data holdings with collection purpose, legal basis, retention period, access controls, and system locations.

Data Flow Diagrams

Visual maps showing how personal data flows through your organisation, including collection points, processing systems, storage locations, and external disclosures.

In practice

A personal data inventory entry shows the data involved, the business purpose, the source, the destination, any overseas transfers, the responsible owner, and the privacy questions that still need to be resolved.

The pressure

Privacy exposure is increasing and nobody can clearly show what personal data is held, where it moves, or who it is shared with.

You leave with a usable personal-data inventory and clearer answers for privacy work, breach readiness, and customer questions.

Privacy exposure grows fast when nobody can trace personal information from collection to storage to sharing. It makes those flows visible so the business can answer Privacy Act questions with something better than assumption.

Good Security maps the personal information you hold, how it moves, where it crosses boundaries, and who needs to own the risk so privacy decisions are based on a real operating picture.

What you leave with

What you walk away with.

These are the deliverables and working records the team should be able to use once the work is complete.

Personal Data Inventory

Full register of all personal data holdings with collection purpose, legal basis, retention period, access controls, and system locations.

Data Flow Diagrams

Visual maps showing how personal data flows through your organisation, including collection points, processing systems, storage locations, and external disclosures.

Cross-Border Transfer Register (Assurance+)

Detailed register of all cross-border personal data transfers with destination countries, safeguards, and IPP 12 compliance status.

Privacy Compliance Gap Report

Analysis of gaps between your current data handling practices and Privacy Act 2020 requirements, with prioritised improvement recommendations.

What that looks like in practice

What should be easier after this lands

What should be easier after this.

These are the outcomes owners, managers, or leaders should notice after the deliverable starts being used.

Personal information flows are visible enough to support privacy, breach, and customer conversations.
Overseas disclosure, retention, and handling issues are easier to spot before they become incidents.
Privacy work stops relying on memory because the inventory becomes the shared source of truth.
Future PIAs, breach reviews, and policy decisions start from a clearer map of what the business is actually doing.

What this service is designed to do

personal-data inventory
data-flow visibility
privacy support foundation

How the work moves

How the work gets done.

You should know what happens first, what gets reviewed, and what lands with the business at the end.

Identify the personal information in scope

We confirm which data sets, processes, and teams matter most for the privacy picture.

Map collection, use, and sharing

Good Security documents where personal information comes from, where it goes, and who touches it.

Highlight the weak points

The inventory shows where disclosure, retention, or ownership is unclear and needs attention.

Deliver the working map

You receive an inventory the business can use for compliance, response planning, and ongoing privacy management.

FAQ

Common questions.

These answers are here to make the next decision easier, not to hide the real scope.

When does Personal Data Inventory make sense? +

Privacy exposure is increasing and nobody can clearly show what personal data is held, where it moves, or who it is shared with. Use this when privacy obligations are getting harder and the business still lacks one reliable view of personal data flows.

What changes after Personal Data Inventory is delivered? +

You leave with a usable personal-data inventory and clearer answers for privacy work, breach readiness, and customer questions.

What often comes next

What usually comes next.

These services are often paired with this engagement when the business needs a broader operating model, more evidence, or stronger follow-through.

Asset, Data & Access Management

Information Asset Register

Know what information the business holds, why it matters, and who owns it before security, privacy, or continuity decisions get made in the dark.

Risk & Vendor Management

Privacy Impact Assessment

Work out whether a project creates privacy risk before launch, with clear decisions, mitigations, and evidence the business can stand behind.

Next Step

Need to turn this into a practical next step?

We will help you decide whether this is the right engagement, what the business should expect to receive, and where it fits in the wider programme.

Book a Free Consultation Take the 2-Minute Security Scorecard