A personal information inventory is a document that assists the Privacy Manager in identifying and responding to a request from an individual about what personal information the organization holds about them and with whom the information is shared. A personal information inventory is a comprehensive and detailed record of all personal information that an organization collects, uses, discloses, stores, and disposes of. It helps an organization map its data flows, assess its privacy risks, comply with its legal obligations, and respond to data subject requests. A personal information inventory should include information such as: the categories and sources of personal information; the purposes and legal bases for processing; the recipients and transfers of personal information; the retention periods and disposal methods; and the security measures and safeguards.
Reference:
CIPM Body of Knowledge (2021), Domain IV: Privacy Program Operational Life Cycle, Section B: Protecting Personal Information, Subsection 3: Data Inventory CIPM Study Guide (2021), Chapter 8: Protecting Personal Information, Section 8.3: Data Inventory CIPM Textbook (2019), Chapter 8: Protecting Personal Information, Section 8.3: Data Inventory CIPM Practice Exam (2021), Question 138