Data Inventory and Classification Audit
Check whether we know what data we hold and where.
Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it (what [VERIFY] means).
Audit our data inventory. List of systems and datasets with owner, data types, location, retention and who has access: [DATA_INVENTORY]. Classification labels in use: [CLASSIFICATION]. Data flows to vendors: [DATA_FLOWS]. Check completeness, unlabelled sensitive data, data kept longer than needed, copies in personal drives, unclear owners and flows not recorded. Propose a simple classification and retention approach proportionate to our size. Return a table with Dataset, Sensitivity, Owner, Gap (red, amber, green) and Action, and a one-page data handling guide. Legal categories and retention are [VERIFY] for [JURISDICTION] with a privacy professional. Also suggest a quick way to find shadow copies of sensitive data in shared drives and email, and a retention clean-up plan that avoids deleting records the organisation must keep. Finish with the dataset to protect first. Then turn the inventory into a data handling programme. Define three or four classification levels in plain words with examples from my organisation, the handling rules for each (storage, sharing, retention, deletion), and who decides. Create a labelling approach that people can follow without special tools, and a quick guide for choosing a level. Propose a retention schedule template with the record type, purpose, retention period to be confirmed, owner and disposal method. Draft a monthly routine to find and tidy copies of sensitive data in shared drives and email. Add a training outline and a short quiz of five questions. Suggest how to link the inventory to the privacy notice and the vendor list. Retention periods and legal categories are [VERIFY] for [JURISDICTION] and must be confirmed with a privacy professional before deletion. Keep severity honest: separate confirmed issues from possible ones, give the evidence for each, and recommend a retest after fixes so that closure is verified and not assumed.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.