Most Accurate Solutions and ApproachesFor Your Data Inventory

What are the types of your data? Where are they stored? Who has access? Have you specified the retention periods?

Not being aware of in which environments the collected data are stored and how they are shared with other parties, is like travelling offshore.

The most important need of an organization for data management; moreover, the starting point of the data management, is to have knowledge about the scale, location, sharing and lifecycle of the data.

The private sector and public institutions obtain, process and store various personal data in order to carry out their core activities. Organizations that wish to expand their economic activities naturally access more personal data and be in the position of sharing them with third parties. If the management model of the data is not adequately constructed, as the scale of data gets larger, the risks to keep it secure and the measures to be taken increase accordingly.

The expert teams of VeriSistem® complete the data inventory studies quickly thanks to their superior knowledge in this field, which can be quite detailed according to the scale of data processed and the parties you share data with. In addition, data inventory service is included in the scope, if all end-to-end personal data protection law compliance studies are in progress.

Envanter Çalışması ile İlgili Çeşitli Tanımlar

Various Definitions Related to the Inventory Study

Inventory study on personal data is not an easy process. However, it cannot be argued that the results of this study spread over time, will become a unique asset in terms of the operation of the organization.

The inventory study on the protection of personal data is described in Article 4, paragraph 1 (h) of the By-law on the Data Controllers’ Registry published in the Official Gazette dated 30.12.2017. Later, the scope was changed with various regulations.

In these regulations, Inventory is described as "the inventory in which the measures taken regarding data security are explained and elaborated as data controllers perform personal data processing activities depending on business processes; their purposes of processing personal data and its legal ground, data category they create by associating with the recipient group of transfer and group of data subject persons and the maximum retention period required for the purposes which personal data processed for and personal data intended to be transferred to foreign countries."

Envanter Çalışması ile İlgili Çeşitli Tanımlar

Why Should You Prepare a Data Inventory?

The obligation to prepare a data inventory is the preparation of infrastructure for compliance with the Law in the business processes related to the activities of the data controllers. In other words, it is to serve easily to determine whether there is a personal data processing that is incompliant with the Law. Thanks to this inventory, the data controller has also the opportunity to self-audit regarding the legal compliance of personal data processing activities.

The aim is to convert the data into information and to transform it into understanding.

Carly Fiorina  HP, Former chief executive officer
Envanter Çalışması ile İlgili Çeşitli Tanımlar

Is it a Legal Obligation to Prepare Data Inventory?

For the reasons mentioned above, it is important to take technical and administrative measures properly in terms securing personal data. Therefore, it will be easier for organizations to classify their data assets in the first place. However, the law also imposed following obligations in this field;

According to Article 5, paragraph 1 (d) of the By-law on the Data Controllers' Registry, the provision "Data controllers (*) who are obliged to register with the Registry, are obliged to prepare Personal Data Processing Inventory. Data to be disclosed to the Registry during the registration applications, are prepared based on the Personal Data Processing Inventory", in paragraph (d) the provision "In the disclosure obligation stipulated in Article 10 of the Law for data controllers, in responding to the applications of the data subject in Article 13 of the Law and determining the scope of the explicit consent to be announced by the data subjects, the data submitted to the Registry and published in the Registry shall be taken as basis based on the personal data processing inventory." takes place.

(*) Amendment has been made in paragraph (ç) with the Article 2 of the Regulation on the Amendment of the By-law on the Data Controllers’ Registry published in the Official Gazette dated 28.04.2019.

Please click here to see the criteria for VERBIS Registration

Envanter Çalışması ile İlgili Çeşitli Tanımlar

Is it compulsory to prepare data inventory according to GDPR?

According to GDPR, there is no obligation to prepare data inventory, but due to the nature of the process, data inventory is "required". Because GDPR examines which data are managed, recorded, shared. In addition to this, organizations with more than 250 employees have to keep the record of data processing activities and show them during the audits (The Register of Record of Processing Activities).

The requirements for data processing activities are listed in Article 30, paragraphs 1 and 2 of the GDPR. According to this;

Name and surname of the data controller, DPO and representatives

Purpose of data processing

Categories of data subject's processed data

Parties where data transfer takes place

Retention periods

Technical and administrative measures

The differences between the conventional Data Retention and the "Transaction Records" mentioned in the GDPR are, for example, as follows;

Data Retention (Saving, storing)

It is important which records we keep in which systems. For example, customer contracts are located on the cloud server named "ABC" in Istanbul.

Who has access to data? For example, who can access supplier data stored in our servers in Ankara? With what types of authorization levels can they access to data?

Transaction Records (Data processing records)

GDPR looks for answers to “how” and “why” questions. Why are these records kept, what is the purpose and how are they kept?

Which departments have access to data and why is this needed?


Contents provided in this article serve to informative purpose only. The article is confidential and property of CottGroup® and all of its affiliated legal entities. Quoting any of the contents without credit being given to the source is strictly prohibited. Regardless of having all the precautions and importance put in the preparation of this article, CottGroup® and its member companies cannot be held liable of the application or interpretation of the information provided. It is strictly advised to consult a professional for the application of the above-mentioned subject.

Please consult your client representative if you are a customer of CottGroup® or consult a relevant party or an expert prior to taking any action in regards to the above content.

Let's start
Get a quote for your service requirements.

Would you like to know more
about our services?