A personal data inventory is the record showing, for each business process, which personal data you process, about whom, why and on what legal basis; where it is stored, who receives it, how long it is kept and how it is protected. Build it process by process with each owner, then check it against your systems.
Why most personal data inventories never leave the drawer
In Türkiye, personal data is governed by Law No. 6698, known as KVKK, and data controllers above the exemption thresholds (plus certain others) must register with VERBİS, the national data controllers' registry. The inventory is the working document behind that registration, broadly comparable to the record of processing activities that the GDPR requires in the EU.
The usual story: someone downloads a spreadsheet template and emails every department asking "what personal data do you process?". HR writes "personnel files", sales writes "customer details", IT does not reply. The filing goes through and the file is never opened again.
The underlying mistake is treating the inventory as a document rather than a data source. Every other part of the KVKK compliance programme draws on it: privacy notices, retention periods, the access matrix and breach notifications. An outdated inventory quietly makes all of them wrong. A second problem is that it is compiled from memory rather than from systems: CVs piling up in a shared mailbox, old payroll exports on the file server or card logs in the access control system rarely surface through a questionnaire.
What a missing or stale inventory costs
Two areas in the regulator's figures depend directly on the inventory. The first is registration:
According to the KVKK 2025 Annual Report, VERBİS had received 249,474 applications by 31 December 2025, while the number of data controllers that had actually filed their notifications stood at 149,118.
The same report shows the Board fined 876 data controllers in 2025, and 594 of those cases related to registry registration and notification duties. In other words, more than two thirds of the fined data controllers were penalised over an obligation whose content comes straight out of the inventory. We cover thresholds and exemptions in our VERBİS registration guide.
The second area is complaints. Per the KVKK 2025 Annual Report, 6,506 complaints in 2025 concerned unlawful processing, 2,838 unlawful sharing with third parties and 551 failure to erase, destroy or anonymise data. All three come back to one question: does the company know what it holds, why, where and who it has given it to?
Not knowing your data is a wider problem too. In the 2025 Outlook: Data Integrity Trends and Insights survey of 565 data and analytics professionals by Drexel University's LeBow College of Business and Precisely, a lack of data governance (62%) was the top data challenge holding back AI initiatives. The personal data inventory is governance's first concrete output on the privacy side.
What fields should a personal data inventory contain?
Türkiye's Regulation on the Data Controllers' Registry defines the inventory as a record linking processing activities to their purposes, legal bases, data categories, recipient groups and data subject groups, and stating maximum retention periods, data intended for transfer abroad and the security measures taken. That is the legal minimum. What makes an inventory usable is the operational columns you add alongside.
| Field | Legally required? | Why it matters |
|---|---|---|
| Business process and owner | Practical | Makes one named person accountable for each row |
| Data subject group | Yes | Privacy notices are written per group |
| Data category (special categories flagged) | Yes | Health or biometric data needs extra safeguards |
| Purpose of processing | Yes | Exposes use beyond the stated purpose |
| Legal basis | Yes | Weeds out unnecessary consent requests |
| Recipient groups and purpose of transfer | Yes | Shows where processor agreements are needed |
| Transfers abroad | Yes | Cloud services and AI tools surface here |
| Maximum retention period | Yes | Feeds the disposal schedule |
| Security measures | Yes | Evidence of access control, encryption, logging |
| System or location (ERP, email, file server, paper) | Practical | Shows the blast radius of an incident quickly |
| Last reviewed | Practical | Flags stale rows |
The system column is the one most often left out and the one most urgently needed during an incident. When you are working against the 72-hour breach notification deadline, "which data subject groups were on the compromised server?" is answered from that column.
How to build a personal data inventory: a seven-step method
The sequence works for a 30-person office and a multi-site manufacturer alike. The core rule is to organise the inventory by process, not by department, because one department processes data for different purposes, on different legal bases and for different periods.
- List the processes. Hold a 30–45 minute interview with each department and ask what work the team actually does: recruitment, payroll, visitor registration, quoting, dispatch, complaints. Interviews catch processes that questionnaires miss.
- Assign an owner to each process. The manager who runs the process owns the accuracy of its rows, not IT or legal.
- Trace the data flow. Where does data come in (web form, email, card reader, camera), which system processes it and where does it go? Shared mailboxes, shared folders and personal spreadsheets become visible here; email archiving under data protection law is a blind spot for many firms.
- Verify against the systems. Compare what people said with what is actually stored: ERP fields, file server folders, attendance and access records, CCTV. The gaps are usually forgotten legacy processing.
- Map purpose and legal basis. Write the basis for each data category. Asking for consent where a contract or legal obligation already applies is a common mistake; flag the rows that genuinely rely on consent.
- Complete recipients, retention and measures. Record recipients such as the external accountant, the cloud email provider or couriers, and any transfers abroad, using our guide to KVKK cross-border transfers. Feed retention periods from the same table as your data retention and disposal policy.
- Approve, publish and schedule reviews. Process owners sign off their rows, and the VERBİS filing and privacy notices are generated from the approved version. Write down the triggers for an update: new software, a new supplier, a new campaign.
Example: recruitment as a single row
Data subjects: job applicants. Categories: identity, contact, work history, education. Purpose: recruiting staff. Legal basis: necessary for entering into a contract. Systems: careers mailbox, HR folder. Recipients: authorised hiring managers. Retention: the period set in the policy, then disposal. Measures: HR-only folder access and a mailbox restricted through file sharing permissions. That single row is the source of the applicant privacy notice, the disposal schedule and the access rule.
Keeping it current: spreadsheet, catalogue or workflow tool?
The first version is almost always a spreadsheet, which is fine; the question is whether it is still accurate in year two. The familiar limits of running things on spreadsheets apply: version confusion, no visible change history and no link to the systems themselves.
| Approach | Best suited to | Strength | Weakness |
|---|---|---|---|
| Shared spreadsheet | Few processes, one site | Quick to start, no tooling | Weak versioning and audit trail |
| Inventory linked to a data catalogue | Firms with a reporting platform | Fed from the same source as system fields | Needs catalogue discipline first |
| Workflow tool or document management system | Multiple sites, frequent change | Approvals, reminders, change log | Needs set-up and clear ownership |
Organisations that already run a data catalogue and data dictionary for reporting can tag personal data fields in the catalogue, so the inventory stops being a second, competing version of the truth. The organisational foundations are covered in our data governance framework. Whichever route you choose, run a full review at least once a year and update rows whenever something changes.
The mistakes we see most often
- One row per department: "HR: identity, contact, personnel file" hides the different bases and retention periods of payroll and recruitment.
- Forgetting paper: visitor books, signed handover forms and archive cabinets belong in the inventory too.
- Missing CCTV and card data: these often sit with facilities rather than IT and get skipped; our guide to CCTV recording and KVKK shows how to document them.
- Copy-pasted measures: the same generic list on every row hides real gaps. Our SME cyber security checklist is a good way to test what is actually in place.
How we build personal data inventories at Digital Bridge
We treat the inventory as a dataset verified against real systems, not as a legal text. Under our data protection compliance consultancy we start with discovery interviews with process owners, then work with your IT team to check where data really sits across email, file servers, ERP, attendance systems and cameras. Differences between what people told us and what the systems hold are reported as a separate findings list.
In the pilot we usually map the two busiest processes end to end, typically HR and sales, and agree the row template with you before rolling out to the rest. We connect data ownership, classification and quality rules through our data governance and quality work, so the privacy inventory and the reporting dictionary do not drift apart.
To keep the inventory alive, we can move approvals and review reminders onto a document management system and build system integrations that read field metadata automatically. Our cyber security team then checks whether the measures written in each row actually exist, by reviewing access rights and logs. On the file side, one tool that makes step 4 easier is our own SmartFiles document management: it searches readable documents for Turkish ID numbers, IBANs, card numbers, phone numbers and email addresses, and flags terms such as health or criminal record as "possible special category data"; it does not store the values, only the counts. That way, which folders hold personal data rests on a record rather than on interviews.
Next step
If you already have an inventory, pick one process and compare its rows with the data actually held in your systems; the size of the gap tells you how far the document can be trusted. If you have none, start with the process list. Our other compliance and security guides are collected on the Cyber Security & Compliance topic page. To have an existing inventory reviewed or a new one built, get in touch and we will agree the scope and prepare a written work plan.