Templates and records · ISO 27701 · Clause 4.3 y 6.1.2

ISO 27701 personal data inventory template

The map of where personal data live: systems, files, copies and suppliers. Without it, risk assessment and responding to an erasure request are done blindfolded.

In one sentence

The personal data inventory links each category of data to the systems, locations, copies and suppliers where it is stored and to those who can access it; ISO/IEC 27701 does not name it as a record as such, but it is the practical basis for setting the scope (4.3), assessing privacy risks (6.1.2) and finding a data subject’s data when they exercise a right.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 27701 · Clause 4.3 y 6.1.2 The 2025 edition is cited: numbers 4 to 10 are clauses; A.1, A.2 and A.3 are the Annex A tables with the controls for the controller, for the processor and common to both.
Type of information: Good practice Good practice supporting clauses 4.3 and 6.1.2
Who fills it in: IT, with the owners of each processing activity IT knows where the data are; the business knows what they are for
When: When setting the scope and whenever systems change It is reviewed together with the risk assessment
How long it is kept: For as long as the processing exists It is a living document: it is updated and the previous version kept, so you can show what it looked like at any point.

What the standard requires

What ISO 27701 demands and what it leaves to your judgement

The standard asks you to know your processing and assess its risks, but it does not require a data inventory by that name. What the auditor does expect is that the organisation knows where the personal data it processes are held: there is no justifying an access control or an erasure deadline without that knowledge.

Many organisations build it into the ISO/IEC 27001 asset inventory by adding a personal data column. That works, provided it distinguishes categories of data and not just systems.

It pays to include what tends to be forgotten: backups, spreadsheet exports, shared mailboxes and test environments holding real data.

Read it in context: Context and scope of the PIMS, in the ISO 27701 Academy

Structure

Fields the template should include

Category of personal data
Processing activities in the record that use it
System, application or medium where it is stored
Physical location or supplier region
Backups and replicas
Profiles with access
Supplier or processor involved
Erasure deadline and deletion method
Asset owner

Example

Example: candidate data at a fictitious consultancy

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Category	Candidates’ CVs and contact details
Processing activity	ROPA-07 · Recruitment
Where it is held	Subscribed job portal, recruitment@ mailbox and shared HR folder
Copies	Daily backup of the shared folder, kept for 30 days
Access	Three recruitment specialists and the HR director
Processor	Job portal provider, servers in the EU
Erasure	One year after the process ends, unless there is consent for future vacancies · Deleted from portal and folder; the mailbox is purged every quarter
Owner	HR director · Kestrel Consulting (fictitious)

At the audit

Mistakes auditors commonly flag

The inventory lists servers but not which personal data each one holds.
Backups and spreadsheet exports are forgotten.
The test environment uses real data and appears nowhere.
The inventory and the record of processing are not linked: two lists that do not add up.

In Kimobox

How this record is kept in Kimobox

1Data categories are linked to the asset inventory and to the record of processing activities.
2Every asset has an owner and a classification, and its review is scheduled.
3Locating data by data subject lets you answer a rights request without searching by hand.

Frequently asked questions

What people ask us before getting started

Is it mandatory?

Not as a document by that name. It is the practical way to meet what is mandatory: setting the scope, assessing risks and locating data so that rights can be honoured and data erased on time.

Can it be the same asset inventory as for ISO 27001?

Yes, provided it adds the privacy dimension: which categories of personal data each asset holds and for which processing activities.

Keep your ISO 27701 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring