Service

Stop searching ten systems every time a customer asks for their data

Map where personal information enters your business, where it goes, and who is responsible before privacy obligations or customer questions catch you out.

Talk through whether this fits See where the wider gaps are

Typical deliverable

Personal Data Inventory

Full register of all personal data holdings with collection purpose, legal basis, retention period, access controls, and system locations.

Data Flow Diagrams

Visual maps showing how personal data flows through your organisation, including collection points, processing systems, storage locations, and external disclosures.

Cross-Border Transfer Register (Assurance+)

Detailed register of all cross-border personal data transfers with destination countries, safeguards, and IPP 12 compliance status.

In practice

A personal data inventory entry shows the data involved, the business purpose, the source, the destination, any overseas transfers, the responsible owner, and the privacy questions that still need to be resolved.

The pressure

Privacy exposure is increasing and nobody can clearly show what personal data is held, where it moves, or who it is shared with

You leave with a usable personal-data inventory and clearer answers for privacy work, breach readiness, and customer questions.

Privacy exposure grows fast when nobody can trace personal information from collection to storage to sharing. A personal-data inventory makes those flows visible so you can answer Privacy Act questions with something better than assumption.

Good Security maps the personal information you hold, how it moves, where it crosses boundaries, and who needs to own the risk so privacy decisions are based on a real operating picture.

Deliverables

The artefacts that land on your desk

A full personal data inventory, data flow diagrams, a cross-border transfer register for IPP 12, and a Privacy Act 2020 compliance gap report

Personal Data Inventory

Full register of all personal data holdings with collection purpose, legal basis, retention period, access controls, and system locations.

Data Flow Diagrams

Visual maps showing how personal data flows through your organisation, including collection points, processing systems, storage locations, and external disclosures.

Cross-Border Transfer Register (Assurance+)

Detailed register of all cross-border personal data transfers with destination countries, safeguards, and IPP 12 compliance status.

Privacy Compliance Gap Report

Analysis of gaps between your current data handling practices and Privacy Act 2020 requirements, with prioritised improvement recommendations.

What that looks like in practice

Outcomes

What stops being a scramble

Personal-information flows are visible enough for breach and customer conversations, overseas disclosure issues surface early, and PIAs start from a shared map instead of memory

Personal information flows are visible enough to support privacy, breach, and customer conversations.
Overseas disclosure, retention, and handling issues are easier to spot before they become incidents.
Privacy work stops relying on memory because the inventory becomes the shared source of truth.
Future PIAs, breach reviews, and policy decisions start from a clearer map of what your business is actually doing.

Process

From kick-off to handover, step by step

Four steps across scoping the personal information in play, mapping collection and sharing, flagging weak points, and handing over the working privacy map

Identify the personal information in scope

We confirm which data sets, processes, and teams matter most for the privacy picture.

Map collection, use, and sharing

Good Security documents where personal information comes from, where it goes, and who touches it.

Highlight the weak points

The inventory shows where disclosure, retention, or ownership is unclear and needs attention.

Deliver the working map

You receive an inventory you can use for compliance, response planning, and ongoing privacy management.

Related services

The engagements that usually come next

Usually pairs with the information asset register for the wider operational picture, or a privacy impact assessment when a project changes personal-data handling

Asset, Data & Access Management

See What Information Runs The Business

Know which information loss would hurt first, who owns it, and where it sits before security, privacy, or continuity decisions get made in the dark.

Risk & Vendor Management

Catch privacy risk before the project launches

Work out whether a project creates privacy risk before launch, with clear decisions, mitigations, and evidence you can stand behind.

Next Step

Not sure if this is the right next step for the business?

Book a call and we'll talk through whether this is the right next step, what you'd walk away with, and how it sits alongside anything the business already has in place.

Talk through whether this fits See where the wider gaps are

Questions buyers ask before committing

When is this the right fit?

Privacy exposure is increasing and nobody can clearly show what personal data is held, where it moves, or who it is shared with Use this when privacy obligations are getting harder and the business still lacks one reliable view of personal data flows.

What changes once the work is delivered?

You leave with a usable personal-data inventory and clearer answers for privacy work, breach readiness, and customer questions.