Inventory Data

ON THIS PAGE:

• Overview
• Step 1: Learn about the data inventory
• Step 2: Plan your approach
• Step 3: Prepare to inventory existing items
• Step 4: Request a business process questionnaire or direct TrustArc access
• Step 5: Create records
• Step 6: Update periodically

---

Overview

To better assist all areas of the University in our shared responsibility to protect personal data, the UW Privacy Office is leading an effort to create a centralized, standardized, and maintained inventory of business processes, systems, and third-party relationships. The data inventory is used to help all areas of the University manage impacts and risks associated with their work activities involving personal data. The collaborative process we are implementing to build our institutional data inventory supports our Office’s goal of building awareness about UW’s Privacy Principles and the Privacy by Design framework.

Benefits

A data inventory helps all areas of the University:

• Aggregate essential information for strategic, tactical, and operational decisions at UW.
• Identify and document the accountable and responsible individuals for the business process, system, and third-party relationships through an enterprise-wide data inventory.
• Inventory and map the flow of data across the UW and with third parties.
• Create a common understanding about where, how, and why personal data are processed (e.g., collected, used, managed etc.).
• Evaluate how the use of personal data aligns with the University’s Privacy Principles and addresses our academic, humanitarian, ethical, and legal obligations.

Starting in autumn 2022, please view the Data Inventory Hub as your workspace for documenting information about your unit’s third-party relationships, systems, and business processes. UW Units will be required to create an inventory of the systems, business processes, and third-party relationships that they are responsible for in the TrustArc Privacy Management Platform.

Step 1: Learn about the UW Data Inventory

Please review the Data Inventory 101 videos for high-level overview of the UW Data Inventory.

The Data Inventory Hub in TrustArc hosts three types of records that document third-party relationships, systems, and business processes associated with data processing. You only need to create records for the third-party relationships that you are responsible for and the systems and business processes that you own. Both new and existing data processing need to be inventoried.

TrustArc defines these terms as follows:

Third party

Within TrustArc, a third party can be a partner or a vendor. A partner is generally any third party that is not a vendor (such as a sponsor or affiliate). A vendor is a supplier or service provider that provides technology or expertise to an organization for a given business purpose (e.g, Salesforce).

System

An application, database, or other technological system or process that processes data for a particular business purpose (e.g, CRM software).

Business process

An operation within a company that processes data for a specific business purpose (e.g., HR recruiting, marketing, student admissions, research, etc.) by using one or more systems to process data.

Step 2: Plan your approach

General project plan

• Identify who will be involved.
• Decide if you want TrustArc access or will use business process questionnaires to create records.
• Review training resources.
• Develop workflows:
  • Identify existing items to be inventoried. Use the UW Data Inventory Project Plan 2.0 to help if needed.
  • Plan to inventory new items as needed.
• Prioritize existing items to inventory.
• Gather information to complete records.
• Create, complete, and maintain inventory records.

Step 3: Prepare to inventory existing items

Identify existing items that need to be inventoried by your unit

• What business processes involve personal data?
• What systems involve personal data? Does your unit own or use the system?
• What third parties are involved?
  • Vendors?
  • Who do you share data with?
  • Who do you receive data from?

Tips

• Only inventory what your unit owns/is responsible for.
• If you own a related third-party relationship, system, and business process, inventory them in that order.
• If you don’t, link to the relevant record created by the unit that owns the third-party relationship or system.

Step 4: Request a business process questionnaire or direct TrustArc access

Once you know who will be involved, decide on the inventory pathway that makes sense for your team. There are two pathways to create data inventory records. You may decide to choose one route or combine the two approaches strategically to collaboratively inventory items with your colleagues. It could, for example, make sense for individuals who manage IT units to have TrustArc direct access, and for units that are primarily responsible for business processes to use the business process questionnaires. You can also start with one pathway and change at a later date.

Step 5: Create records

How to create third party, system, and business process records

Review these resources to learn how the data inventory in TrustArc functions as well as required information for completing third party, system, and business process records.

• Data Inventory User Guide
• Data Inventory 102
• Data Inventory Use Cases
• Glossary of Privacy Terms

Step 6: Update periodically

Please review and update your records on a regular basis. This includes updating records when a contract expires and when systems move from design to production or to decommissioned status.

To ensure that the data inventory can assess risk accurately, the Privacy Office will send reminders to validate your records (timing to be determined).