In this guide · 8 sections
- 01What a personal data inventory is, and why PDPC recommends one
- 02The spreadsheet columns to use
- 03Systems most Singapore SMEs forget to list
- 04How to complete the inventory in one afternoon
- 05Using the inventory in a data breach
- 06Keeping the inventory up to date
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Make one spreadsheet row per system or record type, with columns for what personal data, purpose, where stored, who has access, shared with, retention and security. Start with email, accounting, Shopify or POS, CRM, payroll, WhatsApp and shared drives, then review it yearly.
What a personal data inventory is, and why PDPC recommends one
PDPC's Guide to Developing a Data Protection Management Programme encourages organisations to document the personal data they handle using a data inventory map or a data flow diagram. It says these should cover the business purposes for collecting, using and disclosing the data, the people and third parties who handle it, how it is classified to manage access, and when and how it is disposed of or anonymised.
PDPC compares the two formats: an inventory map is easy to develop, maintain and update, needs no special software or skills, and suits extensive data; a flow diagram is easier to understand at a glance but harder to maintain. For most small businesses, a spreadsheet inventory is the practical choice, with a simple diagram added later if useful.
The inventory is not an end in itself. It is the foundation for most other PDPA work in our PDPA checklist for small businesses: privacy notices, retention, access controls, vendor contracts and breach response all depend on knowing what you hold.
The spreadsheet columns to use
Use one row per system or type of record. These columns cover what PDPC's guide asks for, plus the details you will need in a breach.
| Column | What to write | Example |
|---|---|---|
| System / record | Where the data lives | Shopify customer list |
| Personal data | Types of data, not the data itself | Name, email, phone, address, order history |
| Whose data | Customers, staff, job applicants, suppliers' contacts | Online customers |
| Purpose | Why you collect and use it | Fulfil orders, send receipts, marketing (with consent) |
| Where stored | Vendor and location if known | Shopify (overseas hosting) |
| Column | What to write | Example |
|---|---|---|
| Who has access | Roles or named staff, admin accounts | Owner, 2 staff accounts, fulfilment app |
| Shared with | Third parties and data intermediaries | Courier, payment provider, email marketing tool |
| Sensitive data? | NRIC, financial, health, children's data | No |
| Retention | How long you keep it and why | 5 years for orders (tax records); marketing until opt-out |
| Security | MFA, encryption, backups | MFA on all staff accounts |
Do not paste actual personal data into the inventory. It describes categories and locations, not individual records.
Systems most Singapore SMEs forget to list
Personal data spreads into more places than people expect. Walk through each of these and add a row if you use it:
Places to check
Payroll and HR usually hold the most sensitive data in a small business, such as NRIC numbers, bank accounts and medical information, so give those rows extra attention.
How to complete the inventory in one afternoon
Aim for a complete first draft rather than a perfect one. You can refine it later.
List your systems (30 minutes)
Check your card and bank statements for software subscriptions, and your admin consoles for connected apps. Each paid tool is a likely row.
Ask each team (45 minutes)
Ask sales, operations, HR and accounts what personal data they keep and where, including spreadsheets and chat apps.
Fill in purpose and sharing (45 minutes)
For each row, write why you hold the data and which outside parties receive it. Note vendors that process data for you.
Check access (30 minutes)
In each admin console, list who has accounts and who has admin rights. Remove leavers as you go.
Set retention (30 minutes)
Decide how long each record type is needed. Our data retention policy template has typical periods.
Flag gaps (30 minutes)
Highlight rows with no clear purpose, no MFA, too many people with access, NRIC collection, or data kept forever.
Using the inventory in a data breach
This is where the inventory pays for itself. If a mailbox is hacked or a laptop is stolen, the first questions are: what personal data was there, whose, how much, and how sensitive? Without an inventory, answering takes days.
Under the PDPA, an organisation must assess a suspected breach and, if it is notifiable, notify PDPC within 3 calendar days of concluding that, as set out in PDPC's guide on managing and notifying data breaches. The inventory tells you immediately which data types sat in the affected system, whether NRIC or financial data was involved, and which vendors or customers need contacting. Our guide to PDPA data breach notification covers the full process.
The same map helps with access requests: when a customer asks what data you hold about them, the inventory lists every system to search. See how to respond to a PDPA access request.
Keeping the inventory up to date
An inventory that is never updated becomes misleading. Build small habits around it:
- Add a row whenever you sign up for a new tool that holds customer or staff data.
- Review it once a year, and after any restructuring, new product line or office move.
- Give each row an owner who confirms it is accurate at the annual review.
- Keep it with your other PDPA documents, accessible to your Data Protection Officer.
Every Singapore organisation must appoint a DPO, and maintaining the inventory is a natural part of that role. See our guide to appointing a Data Protection Officer.
Do it yourself or get help?
The afternoon method above works for most small businesses, and PDPC publishes free templates and tools. The harder part is acting on what you find: tightening access, fixing retention, updating privacy notices and vendor terms.
Our PDPA Compliance Pack (S$690) includes a completed personal data inventory for your systems, a privacy policy and notices, retention and breach response procedures, and a list of fixes in priority order. This page is general information, not legal advice.
Frequently asked questions
The PDPA does not name a specific document, but organisations must be accountable for the personal data they hold and protect it. PDPC's guide to developing a data protection management programme recommends a data inventory map or data flow diagram as the way to understand how personal data is collected, stored, used, disclosed and disposed of.
For each system or record type: what personal data it holds, whose data, the purpose, where it is stored, who has access, which third parties receive it, whether it is sensitive, how long it is kept and what security protects it. Add an owner and a last-reviewed date. Do not copy actual personal data into the inventory.
Yes. PDPC notes that a data inventory map is easy to develop, maintain and update and does not need special software or skills. A spreadsheet with one row per system is enough for most small businesses. Larger organisations may add data flow diagrams or dedicated tools, but the content matters more than the format.
It shows immediately what personal data was in the affected system, whose it was and how sensitive it is. That lets you assess quickly whether the breach is notifiable and, if it is, notify PDPC within three calendar days of that assessment and contact affected individuals, instead of spending days working out what was exposed.
Add a row whenever you start using a new system that holds personal data, and review the whole inventory at least once a year. Also review it after major changes such as a new product line, office move, restructuring or change of key software. Assign each row an owner to confirm accuracy.