A customer asks what information your company keeps about them. Your team searches the inbox, booking tool, spreadsheet and support system. No one is sure which record is current, who can see it or when it should be removed.
This is a common operations problem as much as a privacy question. When a business cannot trace its information, staff spend time searching, access spreads by habit and software changes become harder to control. A personal data inventory gives the owner one practical view of what the business handles and why.
Start with the work, not a software list
A personal data inventory is a record of the business activities that use information about identifiable people. Begin with a process such as handling an order, answering a service request, hiring an employee or managing a supplier. Then follow the information through the work.
Treat the personal data inventory as a working operations record with an owner, not as a one-time compliance file.
For each activity, record what information enters, where it comes from, what the team uses it for, which people and providers can access it, where it moves, and how long the business expects to keep it. Name the person who owns the process and the person who can answer questions about the record.
Do not assume that only a large database counts. The Law of Georgia on Personal Data Protection defines personal data broadly and defines processing to include operations such as collecting, accessing, connecting, storing, using and deleting information. The law’s territorial scope covers certain automated processing in Georgia and some processing by controllers outside Georgia using technical means available there, with an exception for technical means used only for transit. The exact application depends on the facts. Read the consolidated Law of Georgia on Personal Data Protection on Matsne.
Make the personal data inventory useful to the people doing the work
A spreadsheet can be enough to begin. Use one row for each distinct activity, not one row for every application. A personal data inventory should let a manager answer a few clear questions:
- What business purpose does this information support?
- Which people are involved, and what categories of information does the process use?
- Which teams, contractors or software providers receive or access it?
- Does it move outside Georgia, and who checks the transfer and safeguards?
- How long does the process need it, and what event starts deletion or review?
- Who approves access, responds to a request, and updates the record when the process changes?
These fields are management prompts, not a substitute for the exact register required by law. Georgia’s law sets written or electronic recordkeeping duties for controllers and special representatives, and it sets separate recordkeeping information for processors. The Personal Data Protection Service’s training standards explain the processing register and its purpose-by-purpose structure. Check the current law and guidance before deciding which role and entries apply to your organization. Read the Personal Data Protection Service’s minimum standards for DPO training.
Use the map to find a small number of concrete risks
Once the personal data inventory covers the main workflows, look for mismatches. Does a former employee still have access? Does a service provider receive fields the task does not need? Does a spreadsheet hold information after the team has moved the active work into another system? Are two records being updated separately, so a correction in one place never reaches the other?
Sort findings by likely effect on people and on the business. Start with records that contain sensitive details, broad staff access, unclear ownership, cross-border movement or a long retention period without a clear reason. This ranking is a practical review method, not a legal risk score.
Use the personal data inventory to assign specific fixes, such as removing an unused field, narrowing access or confirming a retention rule with a qualified adviser.
The Georgian law requires controllers to take appropriate technical and organizational measures. It also addresses the amount of data processed, storage periods, and employee access according to authority. For electronic data, the law requires operations such as access, transfer and deletion to be registered. A personal data inventory helps a business see where to assign an owner and where a more detailed legal or security review is needed.
Set a review rule before the next system change
A personal data inventory goes stale when the company adds a form, changes a supplier, moves a service to a new platform or gives another team access. Add a simple review step to those decisions. Before approval, ask the process owner to update the purpose, information categories, recipients, locations, retention and access entries.
For example, a small online retailer might record that its support team uses order number, contact details and delivery status to answer customer questions. Its inventory would identify the commerce platform, the support tool, the staff roles with access and the provider that handles delivery updates. This is an illustrative example, not a description of a DBG360 client. The owner can then ask whether every field is needed, whether the handoff works, and who closes access when a person changes roles.
Keep the process light enough that people will maintain it. Assign one accountable owner for each activity, agree on a review trigger and keep evidence of changes. Ask local legal or privacy specialists to confirm legal roles, lawful grounds, notices, retention and transfers, especially for sensitive information, monitoring or decisions with significant effects. Rules in the United States or another market do not automatically apply to a business operating in Georgia.
Turn the personal data inventory into an operating improvement
A personal data inventory is useful when it helps the team make a decision. It can show where duplicate entry wastes time, where system integration needs a clear owner, where staff access should narrow, or where a process has no reliable deletion step. Start with one workflow, document what actually happens, and assign a person to close each gap.
Review the personal data inventory after a meaningful change to the workflow, supplier or system so that owners are not relying on an outdated map.
DBG360 can help map the work, clarify responsibilities, review system handoffs and turn findings into a practical improvement plan. If your team is changing software or trying to improve customer operations in Georgia, contact DBG360 to discuss the process.
