4.1 Data Inventory, Classification, and Records of Processing

4.1 Data Inventory, Classification, and Records of Processing

IAPP CIPP/US Body of Knowledge 2.6.1 (effective 1 September 2025) makes information management the largest slice of Domain I. Competency I.C is 18–22 questions inside Domain I's 27–33. The first performance indicator is concrete: know the practices and controls for managing personal information, including data inventory and data classification. Later I.C items on notices, assessments, vendors, and transfers all assume you can find the data. If you cannot name what you hold, where it lives, why you have it, and who else sees it, you cannot run a U.S. privacy program.

The United States has no single federal statute that copies GDPR Article 30's record of processing activities (RoPA). That is not a free pass. Sectoral rules, state comprehensive privacy laws, and Federal Trade Commission (FTC) reasonableness all presuppose that you know your processing. California's California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) and later bills through Stats. 2025, Ch. 67 (AB 1170) (effective 1 January 2026), requires a business to disclose categories of personal information (PI), purposes, sources, and third parties. You cannot populate those disclosures from memory. You populate them from an inventory.

What a PI inventory must capture

Treat the inventory as the master index of processing, not as a server list. A CIPP/US-ready record, for each processing activity or data store, captures at least these fields:

Optional but high-value columns include volume, lawful age of the data subject, encryption state, whether the element is sensitive personal information, the source (consumer, employer, data broker, observed), and the authority that governs it (Health Insurance Portability and Accountability Act of 1996 (HIPAA), Gramm-Leach-Bliley Act (GLBA), Children's Online Privacy Protection Act (COPPA), CCPA, or a sister state law).

A record of processing in a multinational is often the same workbook with extra GDPR columns (legal basis, transfer tool, data protection impact assessment (DPIA) status). Do not tell the exam that every U.S. retailer must keep an Article 30 RoPA. Do tell the exam that a U.S. company that is a GDPR controller or processor does need that record for its EU processing, and that a U.S.-only company still needs an inventory to honor state notices, consumer rights, and assessments.

Classification schemes versus statutory sensitive PI

Classification is an internal control language. A common four-tier scheme is:

Those labels are not statutes. Sensitive personal information under Cal. Civ. Code § 1798.140(ae) is a defined list. As of the 1 January 2026 text it includes PI that reveals a Social Security, driver's license, state identification, or passport number; account log-in or financial-account number in combination with a credential that allows access; precise geolocation (a device-derived location inside a circle of radius 1,850 feet); racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership; contents of mail, email, or text messages unless the business is the intended recipient; genetic data; and neural data — information generated by measuring central or peripheral nervous-system activity that is not inferred from nonneural information. It also includes biometric processing to uniquely identify a consumer, and PI collected and analyzed concerning health, sex life, or sexual orientation. Publicly available information in the statutory sense is carved out.

Other comprehensive state laws use their own sensitive data lists (often including children's data, precise location, and account credentials). HIPAA protected health information (PHI), GLBA nonpublic personal information (NPI), and COPPA personal information of a child under 13 are sectoral overlays. A Social Security number can be restricted in the classification scheme, sensitive PI under the CCPA, and NPI if a GLBA financial institution holds it. The exam wants you to stack those labels, not pick one and ignore the others.

Worked classification. A fitness app stores (1) a public blog post, (2) a customer email used only to ship a water bottle, (3) a hashed password plus account number, and (4) a consumer's neural-headset stream. (1) is public. (2) is confidential customer PI. (3) is restricted and California sensitive PI because it is an account log-in in combination with a credential. (4) is restricted and California sensitive PI as neural data. Calling all four "internal" fails both the operational scheme and the statute.

How inventory feeds assessments and vendor scoping

A data protection impact assessment in GDPR language, or a data protection assessment / risk assessment in U.S. state language, is only as good as the inventory behind it. You cannot assess the risk of selling precise geolocation if the inventory still says the company "does not collect location." You cannot decide whether a new model-training use is a new purpose if the inventory never recorded the original purpose.

The California Privacy Protection Agency (CPPA) risk-assessment, cybersecurity-audit, and automated decisionmaking technology (ADMT) regulations were approved by the Office of Administrative Law on 22 September 2025 and are effective 1 January 2026. Covered businesses must begin performing required risk assessments for in-scope processing on that date; the first assessment submissions to the CPPA are due 1 April 2028 for assessments conducted in 2026 and 2027. Sister state laws (Colorado, Virginia, Connecticut, Texas, and others) already required assessments for targeted advertising, sale, sensitive-data processing, or certain profiling. Every one of those assessments starts with "what PI, for what purpose, shared with whom."

Vendor scoping uses the same feed. If the inventory lists a cloud bucket of customer exports that marketing emails to a freelancer, that freelancer is in scope for a data processing agreement, security review, and CCPA role analysis. If the inventory is silent, the freelancer is an invisible third party. FTC Start with Security guidance and the GMR Transcription matter teach the same lesson from the security side: you cannot supervise a service provider you have not identified.

Exam trap: inventory is not a one-time spreadsheet

The most reliable I.C trap is the finished workbook. A privacy analyst runs a three-week discovery project, exports a spreadsheet, stores it on a shared drive, and declares the company "inventoried." Two years later the company has migrated to a new customer-relationship platform, hired an ad-tech tag manager, stood up a data lake in a second cloud region, and bought a lookalike file from a broker. The spreadsheet still says "on-premises CRM, no advertising partners." That artifact is evidence of a stale control, not of compliance.

A living inventory has a refresh trigger: new system, new vendor, new purpose, new location, merger, or a material product change. It has an owner. It is reconciled to the privacy notice, to the records-retention schedule, and to the vendor register. It is used, not archived.

Worked scenario. A national retailer prepares its first CCPA notice. Legal drafts categories from last year's marketing slide. During a tabletop, security reveals that store Wi-Fi logs MAC addresses, the loyalty app collects precise geolocation inside the 1,850-foot definition, and a vendor receives nightly customer extracts to train a recommendation model. None of those elements are in the spreadsheet. The correct move is to update the inventory first, reclassify location and any credentials as sensitive where the statute says so, then rewrite the notice, the retention schedule, the vendor contract, and the risk assessment. Publishing the old notice and calling the spreadsheet "done" is the failure mode the exam is written to catch.