Leadership and readiness
Data map vs data inventory: what's the difference?
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
A data inventory lists the records a company holds, where they sit and who owns them; a data map shows how those records move between systems, vendors and people. Build the inventory first, then map only the flows that matter for the decision in front of you, such as a privacy request, a migration or a licensing review.
Key takeaways
- A data inventory answers what and where; a data map answers how records move, to whom and why.
- Inventories are organized by system and record family, while maps are organized by flows between a source and a destination.
- A GDPR-style record of processing activities is organized by purpose and draws facts from both documents.
- Build the inventory first, because a map drawn without one misses systems nobody remembered.
- A data licensing fit check needs only metadata-level inventory facts to start.
What is the difference between a data map and a data inventory?#
A data inventory is a catalog of the records a company holds, and a data map is a picture of how those records travel. The inventory has one row per system or record family: the help desk, the CRM, the ERP, the shared drive. The map has one line per flow: tickets syncing from Zendesk into Salesforce, order data leaving NetSuite for a carrier over EDI, call recordings going to a transcription vendor.
The two are often confused because many privacy tools produce both from the same questionnaire. They answer different questions, though, and they go stale at different speeds. An inventory changes when you add or retire a system. A map changes every time someone builds an integration, signs a vendor or changes a workflow.
| Dimension | Data inventory | Data map |
|---|---|---|
| Core question | What records do we hold, and where? | Where do records come from, and where do they go? |
| Unit of entry | A system or record family | A flow between a source and a destination |
| Typical format | Register or spreadsheet, one row per system | Flow table or diagram with vendors and transfer methods |
| Usual owner | COO, IT lead or records owner | Privacy lead or general counsel, working with IT |
| Goes stale when | Systems are added, retired or migrated | Integrations, vendors or purposes change |
| Best for | Scoping, retention, migrations, diligence, licensing fit checks | Privacy notices, vendor contracts, breach response, transfer reviews |
What fields belong in a data inventory?#
A useful data inventory records enough about each system that someone outside IT can judge what it holds without opening it. That means plain descriptions of record families and their history, not table names or schema dumps.
Tag the people in each record family by type: customers, employees, job applicants or business contacts at other companies. The tag matters because privacy laws may treat these groups differently. California's CCPA exemptions for employee and business-to-business personal information expired on January 1, 2023, while the Colorado Attorney General states that the Colorado Privacy Act does not cover individuals acting in a commercial or employment context.
- System and owner: for example Zendesk, owned by the support director.
- Record families: tickets, macros, satisfaction surveys, internal notes.
- Date coverage: the earliest year still accessible, and any gaps left by past migrations.
- Volume: the counts the system reports, not estimates from memory.
- People in the records: customers, employees, applicants, business contacts.
- Sensitive categories: payment details, health information, government IDs.
- Retention rules: automatic deletion schedules, legal holds and plan limits on history.
- Restrictions: customer agreements, vendor terms and NDAs that touch the records.
- Export route: built-in export, API, database access or a vendor support request.
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
What does a data map add that an inventory cannot?#
A data map adds direction, purpose and the parties in between. For each flow it records the source system, the destination, the method (API sync, file transfer, EDI, manual upload), the vendor or partner that receives the data, how often it moves and why.
That detail is what privacy work runs on. A privacy notice has to describe who receives personal information and for what purpose. A vendor contract review needs to know which processors touch which records. A breach response team needs to trace where a compromised dataset was copied. None of that is visible from a list of systems.
Maps also expose shadow copies. A frequent finding is that a CRM export was loaded into a reporting tool or warehouse years ago and has refreshed ever since. That copy belongs on the inventory too, which is one reason to reconcile the two documents whenever either changes.
Where does a ROPA fit?#
A record of processing activities, or ROPA, is a GDPR document organized by purpose rather than by system or flow. Each entry describes an activity such as payroll, recruiting or customer support, with the categories of people and data involved, the recipients, any transfers and the retention period. It draws its facts from both the inventory and the map.
Most US companies with no EU operations do not keep a document called a ROPA. US state privacy laws still create duties that are hard to meet without the same facts, such as answering access and deletion requests or describing data practices accurately. Which laws may apply depends on where your customers and staff live and on each law's thresholds, so confirm scope with counsel.
| Document | Organized by | Main use |
|---|---|---|
| Data inventory | System and record family | Knowing what exists and where it lives |
| Data map or flow map | Source-to-destination flows | Knowing how data moves and who receives it |
| ROPA | Processing purpose | Explaining why and how personal data is processed |
| Dataset summary for licensing | A defined record set | Showing a buyer what is offered, with rights and preparation noted |
When do you need each one?#
The inventory comes first in almost every case, and the decision in front of you determines how far to extend it into a map. Mapping everything before inventorying anything is the most common way these projects stall: teams draw detailed diagrams of marketing integrations while the archived support history on a retired server never appears anywhere.
| Situation | Start with | Then add |
|---|---|---|
| Privacy access or deletion request | Inventory rows tagged for that type of person | Flows to vendors that hold copies |
| Retiring a help desk, CRM or ERP | The old system's record families and history | Flows that still pull from it |
| Vendor security review or renewal | The inventory entry for that vendor's system | What the vendor receives and returns |
| Acquisition diligence | Inventories for both companies | Flows that will change at integration |
| Data licensing fit check | Metadata for candidate record families | Only the flows that touch those records |
| Writing a retention policy | Current deletion rules by system | Flows that create copies outside the policy |
Illustrative: a 3PL builds both, in order#
Illustrative: a fictional third-party logistics company runs a WMS in its warehouses, a TMS for carrier routing, NetSuite for billing, Zendesk for shipper support and EDI feeds with its largest customers. The COO wanted to know whether its service exception history could be licensed, and the general counsel needed the privacy notice refreshed.
The team built the inventory first and found an archived ticketing system from before the Zendesk migration that still held years of exception notes. It then mapped two areas in detail: flows carrying driver and consignee details, which the notice needed, and flows feeding the exception records, which the fit check needed. Customer EDI feeds were tagged with the contracts that govern them, and records under restrictive shipper agreements were marked for exclusion.
The result was one inventory serving both projects and two focused maps, instead of a company-wide diagram nobody would maintain.
How SourceX uses an inventory in a licensing review#
SourceX starts a licensing conversation from inventory-level metadata. The fit check asks which systems hold which record families, how many years are accessible and which restrictions are already known; it collects no files, and nothing is shared during the initial assessment.
Flow detail matters later, in the Rights and Preparation steps of the SourceX five-step transaction, when the questions become which contracts govern a record set and where personal or confidential details must be removed. The outcome is recorded in the SourceX Evidence Packet: provenance, licensing rights, permitted use, the privacy record and release authorization. Public standards follow similar logic: the Use group of the Data & Trust Alliance's Data Provenance Standards includes elements such as confidentiality classification, consent documentation location, license to use and intended data use, which are facts an inventory and a focused map can supply.
Frequently asked questions
Is a data inventory the same as a data catalog?
Not quite. A data catalog usually describes tables and fields in a warehouse or lake so analysts can find them. A data inventory covers every system that holds records, including SaaS tools, shared drives and archives that never reach the warehouse. Many companies keep both, with the catalog covering only part of the inventory.
How often should a data map be updated?
Update it when something changes rather than on a fixed calendar: a new integration, a new vendor, a retired system or a new purpose for existing data. Tie updates to the procurement and change-management steps you already run, so a new flow cannot go live without someone recording it.
Can one spreadsheet hold both the inventory and the map?
Yes, for most mid-size companies. Keep one tab with a row per system and a second tab with a row per flow, linked by system name. Draw a diagram from the flow tab when someone needs a picture. Dedicated software makes sense once the number of systems and vendors outgrows a shared spreadsheet.
Is there a standard framework for inventory and mapping work?
The NIST Privacy Framework, released January 16, 2020, is a voluntary framework organized around five functions: Identify-P, Govern-P, Control-P, Communicate-P and Protect-P. Inventory and mapping work sits naturally under Identify-P. Many companies borrow its structure without pursuing any formal attestation.
Does a licensing fit check need a full data map?
No. A fit check needs inventory-level facts about the candidate record families: systems, years of history, rough volumes and known restrictions. Flow detail is added later, and only for the records that move forward, when rights and preparation are reviewed.
Sources
- The California legislature ended its 2022 session without extending the CCPA employee and business-to-business personal information exemptions, so the exemptions expired on January 1, 2023. Source
- The Colorado Attorney General states that the Colorado Privacy Act protects personal data of residents acting in an individual or household context and does not cover individuals acting in a commercial or employment context. Source
- The Use group of the Data & Trust Alliance Data Provenance Standards includes elements for confidentiality classification, consent documentation location, license to use and intended data use. Source
- NIST released the NIST Privacy Framework Version 1.0 on January 16, 2020, organized around five functions: Identify-P, Govern-P, Control-P, Communicate-P and Protect-P. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.