A personal data inventory is a structured record of what personal data an organization holds, where it is stored, how it moves, and who can access it. It typically covers databases, file shares, SaaS tools, backups, logs, and third-party processors, along with the purpose and legal basis for each data set.
This matters in cyber security because you cannot protect, delete, or disclose data you have not mapped. Inventories support access control reviews, retention enforcement, incident response, and privacy compliance. In attacks, poor inventory practices let sensitive records hide in forgotten systems, shadow IT, or excessive access paths, increasing the blast radius of a breach. In defenses, a current inventory helps teams prioritize high-risk assets, verify consent and notice alignment, and limit integration risk during mergers or system changes.