Categories of PI mapped to sources, purposes, and recipients
Why it matters
CCPA § 1798.100(b) and § 1798.110(c) require disclosures of PI categories, sources, purposes, and recipients — disclosures that are nearly impossible to make accurately without a data inventory. A privacy policy authored from memory invariably omits PI flows added in later sprints: a Stripe webhook that starts writing billing addresses to a CRM, a new analytics provider, a third-party enrichment API. The inventory is not itself a statutory requirement, but its absence makes every required disclosure unreliable. GDPR Art. 30 and ISO 27001:2022 A.5.9 treat the inventory as a foundational compliance artifact; CCPA regulators apply the same expectation during investigations.
Severity rationale
Info because a missing data inventory does not independently constitute a CCPA violation, but it makes every CCPA disclosure requirement harder to fulfill accurately and is often the root cause of policy gaps.
Remediation
Create a DATA_INVENTORY.md in the repository root (or a linked spreadsheet) that maps every PI category to its source, processing purpose, third-party recipients, and retention period. Treat it as living documentation — update it whenever a new data collection point or third-party integration is added.
DATA_INVENTORY.md
| CCPA Category | Examples | Source | Purpose | Recipients | Retention |
|--------------------------|-------------------|---------------------|-------------------|---------------------|----------------|
| Identifiers | Email, user ID | Consumer (signup) | Account mgmt | SendGrid (email) | Until deletion |
| Internet/network activity| Pages, clicks | Auto (app events) | Analytics | Google Analytics | 26 months |
| Commercial information | Purchase history | Consumer (checkout) | Order fulfillment | Stripe (payments) | 7 years |
| Geolocation data | Country from IP | Auto (request log) | Fraud detection | None | 90 days |
| Inferences | Inferred prefs | Derived (app logic) | Personalization | None | Until deletion |
Last updated: [date] | Owner: [role] | Next review: [date + 6 months]
Once the inventory is complete, cross-reference it against the privacy policy's category disclosures — every row in the inventory that is not reflected in the policy is a CCPA § 1798.130(a)(5) disclosure gap.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the CCPA/CPRA Readiness Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- ccpa · §1798.100(b) — Data inventory — foundational prerequisite for accurate category-of-PI disclosures
- ccpa · §1798.110(c) — Disclosure of categories of PI collected, sources, and purposes requires maintained inventory
- gdpr · Art. 30 — Records of processing activities — data inventory/register obligation
- nist:rev5 · PT-7 — Specific categories of personally identifiable information — maintain inventory of PII
- iso-27001:2022 · A.5.9 — Inventory of information and other associated assets
- ccpa · §1798.130(a)(5) — Notice and disclosure requirements — privacy policy contents
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ccpa-readiness·automated