A data inventory is a list of the personal and sensitive information you hold, where it lives, who can access it and how long you keep it. You can build a useful one in an afternoon with a spreadsheet. It is the base for every other security decision.
Why start here
You cannot protect, back up, restrict or delete data you have not found. In small organizations, sensitive information drifts: a spreadsheet of donors on a laptop, a form that stores addresses, an old export in a shared folder.
The FTC's Safeguards Rule, which applies to certain financial institutions, lists a data inventory among the safeguards it expects. You may not be covered by that rule, but the habit is a sound one for anyone.
The columns
Keep it simple:
- Data type: names and emails, donation records, student records, health notes, ID numbers, photos of minors
- System or location
- Owner (a named person)
- Who has access
- Why you hold it
- How long you keep it
- Is it backed up and is it encrypted
How to find the data
Walk through the year. What does a donor do? They give, you thank them, you send a receipt, you may email them. Each step touches a system.
What does a student or client do? Enroll, attend, get support, leave. Same walk.
Then ask staff and volunteers: where do you keep lists? You will hear about spreadsheets, notes apps and personal email. Do this without blame, or people will not tell you.
Decide what you do not need
For each row, ask whether you need the data at all. Data you delete cannot be breached. Set a retention period and a date to review. The FTC's Safeguards Rule page mentions secure disposal of customer data within two years of last use, unless there is a business or legal reason to keep it. Use it as a reference point, not a legal ruling for your case.
Mark the high-risk rows
Anything involving children, health, ID numbers, bank details or immigration status deserves tighter access and better backups. Put those on your multi-factor authentication list first.
Keep it alive
Review the sheet twice a year, and whenever you adopt a new tool. A new tool is a new place for data to land.
Quick check
Do I need special software to build a data inventory?
No. A spreadsheet with an owner for each row is enough to start. The value comes from keeping it current.
Sources
Last reviewed: 19 October 2026.
