Personal information inventory

How to use this

The Privacy Commissioner’s second pou is “know your personal information”. Every other task, from writing a privacy statement to responding to a breach, depends on it. The spreadsheet has two worked example rows; delete them when you start.

Don’t try to do it alone from your desk. Spend 30 minutes with each team using the interview guide below. People know where the real spreadsheets are.

Personal information inventory: interview guide

Use one row of the spreadsheet for each distinct set of personal information, such as “customer accounts”, “volunteer contact list”, “CCTV footage” or “payroll”.

Questions for each team

What do you hold?

1. What information about people does your team collect, create or receive? Think about customers, staff, volunteers, contractors, children, members of the public.
2. Is any of it sensitive, such as health, financial, identity documents, children, ethnicity, beliefs, justice, location of people at risk?
3. Are there spreadsheets, shared mailboxes, paper files, phone photos, messaging groups or personal accounts holding it?

Where does it come from?

4. Does it all come from the people themselves? If not, where else? (Referees, credit reporters, partner organisations, parents, public sources, social media.) Each “someone else” is an IPP 3A question.

Why do you have it?

5. What do you use it for? Is every item needed?
6. Is any of it used for something other than the reason it was collected?

Where does it live and who sees it?

7. Which systems or places is it stored in?
8. Does a supplier hold it for us? Do they use it for anything of their own?
9. Is any of it stored or accessed outside New Zealand?
10. Who can access it? Is that more people than need to?

Who gets it?

11. Do you share it with anyone outside the organisation? Why, and on what basis?

How long?

12. How long do you keep it? Do you ever delete it? Who would?

After the interviews

• Give every row an owner: the manager who decides who can access it and approves new uses.
• Highlight rows with no retention period, sensitive information, overseas storage, indirect sources or wide access. These are your priorities.
• Review the inventory once a year, and whenever you add a system or supplier.