# Standards and Regulatory References — Data Inventory and Mapping

## Primary Legislation

### GDPR — Regulation (EU) 2016/679

- **Article 30(1)**: Controller obligation to maintain records of processing activities containing: controller identity, purposes, categories of data subjects, categories of personal data, recipients, third-country transfers, retention periods, and security measures description.
- **Article 30(2)**: Processor obligation to maintain records containing: processor identity, categories of processing carried out on behalf of each controller, third-country transfers, and security measures.
- **Article 30(3)**: Records shall be in writing, including electronic form.
- **Article 30(4)**: Records shall be made available to the supervisory authority on request.
- **Article 30(5)**: Exemption for organisations with fewer than 250 employees — but only if processing is not likely to result in risk, is occasional, and does not include special categories or criminal data.

### UK Data Protection Act 2018

- **Section 30**: Implements Art. 30 record-keeping requirements in UK law.
- **Section 30(5)**: UK implementation of the SME exemption with same conditions as Art. 30(5) GDPR.

## Regulatory Guidance

### EDPB — Position Paper on the Templates for Records of Processing Activities (2018)

- **Key Content**: EDPB recommended template fields for RoPA, emphasising that Art. 30 lists minimum required fields and controllers should include additional fields as needed for demonstrating compliance.

### ICO — Documentation and Records Guidance (2024)

- **Key Content**: Detailed guidance on maintaining Art. 30 records, including recommended fields beyond the minimum: lawful basis per activity, source of data, automated decision-making details, and DPIA reference.
- **Practical Recommendations**: The ICO advises that records should be a living document reviewed at least annually, and that automated data discovery tools should supplement manual records.

### CNIL — Data Mapping Model and Template (2020)

- **Reference**: CNIL Data Mapping Guide (Registre des activités de traitement — modèle de registre simplifié)
- **Key Content**: Provides a simplified register template for SMEs and a comprehensive template for larger organisations. Includes guidance on identifying processing activities, categorising data, and maintaining records.

### Article 29 Working Party — Position Paper on Derogation from the Obligation to Maintain Records (WP243, 2018)

- **Key Content**: Narrow interpretation of the Art. 30(5) SME exemption — the exemption does not apply if the organisation processes special category data, criminal data, or data likely to result in risk to individuals. In practice, most organisations must maintain full records regardless of size.

## Industry Standards

### ISO/IEC 27701:2019 — Privacy Information Management System (PIMS)

- **Clause 7.2.8**: Inventory of PII processing — the organisation shall determine and document categories of PII, processing purposes, security measures, and access controls.
- **Clause 7.4.1**: Privacy impact assessment (PIA) — PIAs require accurate data inventories as input.
- **Clause 7.5.2**: Transfer of PII — organisations must document PII transfers, including cross-border transfers.

### NIST Privacy Framework v1.0 (January 2020)

- **ID.IM-P1**: Systems, products, and services that process data are inventoried.
- **ID.IM-P2**: Owners or operators of systems processing data are identified.
- **ID.IM-P3**: Data processing ecosystem is mapped, including personal data flows.
- **ID.IM-P4**: Data actions of the systems are inventoried.

### AICPA SOC 2 Trust Services Criteria (2022)

- **CC6.1**: Logical and physical access controls — requires understanding of where sensitive data resides to implement appropriate controls.
- **P3.1**: Personal information is collected consistent with notice and consent — requires data mapping to verify.