Scripe
SCRIPEDOCS

Data Inventory

A registry of all personal data categories the platform processes — required for GDPR Article 30 Records of Processing Activities (RoPA).

The Data Inventory is a structured registry of all personal data categories that the platform processes. Under GDPR Article 30, controllers must maintain Records of Processing Activities (RoPA) — the Data Inventory is SCRIPE's implementation of this requirement.

Data Discovery & Mapping Flow

Automated and manual discovery workflows for cataloging PII fields, sensitivity levels, and cross-border data transfer destinations.

Module Seed — Pre-configured baseline inventory schemas loaded on module installation.
Seed to Discovery
Automated Discovery — Scans database catalogs and metadata to detect personal data fields.
Discovered to Matching
Pattern Matching — Applies heuristic and regex classifiers against known PII patterns.
Matching to Classification
Classification — Tags identified fields with sensitivity levels and category labels.
Classification to Legal Basis
Legal Basis — Assigns lawful processing grounds (Art 6 Consent, Contract, Legal Obligation).
Legal Basis to Retention Link
Policy Linking — Associates inventory fields with applicable retention and destruction schedules.
Link to ROPA Compilation
ROPA Generation — Compiles Article 30 Records of Processing Activities documentation.
ROPA to Audit Export
Export & Audit — Generates tamper-evident audit packages and compliance reports.

Sensitivity Classifications

Categorization of data into Public, Internal, Confidential, and Restricted PII tiers to enforce appropriate encryption and masking controls.

Sensitivity LevelDescriptionTypical Data Fields
PublicPublicly accessible business information with zero privacy risk.Company name, public email, corporate phone, published addresses.
InternalOperational data accessible to authorized employees without elevated privacy risks.Internal user ID, employee badge, team code, system metadata.
ConfidentialPersonally identifiable information (PII) requiring strict access controls and lawful basis.Personal email, mobile number, home address, device identifiers, IP addresses.
RestrictedSpecial category data subject to heightened regulatory safeguards and statutory restrictions.Government national IDs, passwords, financial records, biometric signatures.

Inventory Metadata Schema

Data dictionary schema detailing field names, storage destinations, legal processing bases, and retention policies.

DataInventoryItem.csC#
public class DataInventoryItem : AuditableEntity<Guid>
{
    public Guid? TenantId { get; set; }

    [Required, MaxLength(100)]
    public string ModuleName { get; set; } = null!;

    [Required, MaxLength(200)]
    public string EntityName { get; set; } = null!;

    [Required, MaxLength(200)]
    public string FieldName { get; set; } = null!;

    [MaxLength(1000)]
    public string? Description { get; set; }

    [MaxLength(2000)]
    public string? Note { get; set; }

    [MaxLength(100)]
    public string DataCategory { get; set; } = "Identity";

    public bool IsAnonymizedOnErasure { get; set; } = true;

    public bool IsIncludedInExport { get; set; } = true;

    [MaxLength(100)]
    public string LegalBasis { get; set; } = "contract";

    public new bool IsActive { get; set; } = true;
}

Inventory Entities

Field NameData TypeA registry of all personal data categories the platform processes — required for GDPR Article 30 Records of Processing Activities (RoPA).
TenantIdGuid?Unique identifier of the tenant owning the inventory record.
ModuleNameStringSource bounded context or module where the field is persisted.
EntityNameStringDomain entity or relational table containing the personal data attribute.
FieldNameStringDatabase column or property storing the personal data.
DescriptionString?Functional description of the field purpose and operational necessity.
NoteString?Regulatory guidance, statutory compliance citations, or compliance team notes.
DataCategoryStringHigh-level classification (e.g. Identity, Financial, Communication, Telemetry).
IsAnonymizedOnErasureBooleanWhether field data is masked or overwritten upon DSR erasure execution.
IsIncludedInExportBooleanWhether field data is packaged into Article 15 Data Portability archives.
LegalBasisStringLawful processing justification under GDPR Article 6.
IsActiveBooleanWhether the inventory definition is currently enforced in compliance audits.

API Endpoints

MethodEndpointDescriptionAuth
GET/api/v1/compliance/data-inventoryRetrieve paginated list of personal data inventory records with filtering options.🔒 Required
POST/api/v1/compliance/data-inventoryRegister a new personal data field definition in the tenant data inventory.🔒 Required
PUT/api/v1/compliance/data-inventory/{id}Update an existing data inventory item metadata, sensitivity, or legal basis.🔒 Required
PreviousData Retention PoliciesNextCompliance Reports