A data inventory is useful when it explains how information is actually used and where the organization’s promises can fail. A list of software systems is not enough.
Consider a hypothetical credentialing organization. It collects candidate registration details, accommodation documentation, and exam results. Staff export some records to a service vendor, then enable an AI feature to summarize support cases. Later, a candidate asks about deletion.
The first distinction is why each record exists
Contact information used to schedule an exam, medical documentation supporting an accommodation, and evidence supporting a disputed result serve different purposes. They may require different access and retention treatment even though they concern the same candidate.
The legal analysis also depends on the holder and context. Health-related information does not automatically make an organization a HIPAA-covered entity. HHS describes the covered-entity and business-associate framework. Other privacy laws, contractual commitments, or confidentiality duties may still apply.
An export can move beyond the approved purpose
Suppose the vendor needs scheduling information but receives an export containing accommodation records. The organization has disclosed more than the service requires. A generally approved vendor relationship does not establish that every field belongs in every transfer.
The relevant question is which information the vendor needs and what permissions and protections govern that transfer. A privacy notice that describes limited use can become inaccurate if the operating practice is broader.
A new feature can create a new use
The support vendor later offers AI summaries. Enabling the feature may send case text to another provider or subject it to different retention and improvement terms. The organization’s original approval of the support platform may not have addressed that use.
A no-training setting answers one question, not every question about processing, access, or retention. AI Vendor Contracts and Data Platform Rights, Reuse, and Exit examine those distinctions.
A deletion promise must account for the copies
Deleting the candidate’s main profile may leave an exported spreadsheet, vendor support record, backup, or evidence file. The organization should understand what its deletion statement actually covers and whether a legal retention requirement or dispute changes the response.
Keeping everything indefinitely is not the answer either. It can enlarge the information exposed in an incident and leave the organization unable to explain why sensitive records remain. The FTC’s information-protection guidance emphasizes knowing the information held and retaining what the business needs.
Jurisdiction needs facts, not assumptions
A privacy regime’s reach can depend on location, activities, affected people, and statutory thresholds or roles. The GDPR’s Article 3, for example, addresses territorial scope through specified connections; worldwide website accessibility alone does not supply the complete analysis.
In this scenario, the useful outcome is an identified flow, an explanation of where the proposed use exceeds permission, and a decision about collection, transfer, feature use, or retention. The Technology, AI, and Data Risk Guide connects those decisions to procurement and oversight.
