How to Build a Data Inventory
A data inventory is a simple table that says what personal data you hold, why, where, who can see it and how long you keep it. Every other duty (notice, consent, requests, breaches, erasure) depends on it. This DPDPA 2023 course page explains how to build a data inventory in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
Advertisement
Follow the life of the data (tap each stage) (how to build a data inventory)
Tap or click a step to see exactly what to do.
Step by step
- List the systems. Walk through the business: website, store, app, CRM, email marketing, payroll, HR files, accounting, support tool, analytics, cloud drives, phones.
- List the data in each. Name, phone, email, address, ID numbers, location, device IDs, payment tokens, photos, employee records.
- Write the purpose. One short reason per data item, such as “deliver order”.
- Write the legal basis. Consent, or a Section 7 legitimate use such as legal obligation or employment.
- Note who gets it. Internal teams and outside vendors, and whether any are abroad.
- Note where and how long. System, country, how long you need it, and when it is deleted.
- Flag special cases. Children, large volumes, automated decisions.
- Assign an owner for each row and review every quarter.
Advertisement
Template (how to build a data inventory)
| System | Data | Purpose | Legal basis | Shared with | Location | Keep for | Owner |
|---|---|---|---|---|---|---|---|
| Online store | Name, phone, address, order history | Deliver orders, support | Consent / contract performance via voluntary provision | Courier, payment gateway | India cloud | 3 years after last order | Operations |
| Newsletter tool | Marketing | Consent (separate) | Email vendor | Vendor cloud (check country) | Until unsubscribed | Marketing | |
| Payroll | Employee name, bank details, ID | Pay salary | Employment purposes (Section 7) | Accountant | India | As law requires | HR |
Tip
Start with the three systems that hold the most data. A 70% accurate inventory today is better than a perfect one in six months.
Start with the three systems that hold the most data. A 70% accurate inventory today is better than a perfect one in six months.
Common mistakes
- Forgetting spreadsheets and email attachments that contain personal data.
- Forgetting backups and old devices.
- Writing a vague purpose like “business use”.
Related guides (how to build a data inventory)
Educational material, not legal advice. Based on the DPDP Act, 2023 and the DPDP Rules, 2025 (Gazette notification of 13 November 2025). Always check the official text on the MeitY website.
Official sources for how to build a data inventory: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.