A table with one row per tool: which data is stored there, who has access, whether a data processing agreement exists and where the data is stored.
Where you do not know something, you enter unknown instead of a guess. You mark the three rows with the greatest open risk and clarify them first. The inventory is a stocktake; it does not describe a workflow.
Example from Module 2
A building block “Data inventory” with the completed table and the three marked risk rows.
Module 2: “Protecting data: encapsulate and check”. In the Werkbank course room, with sign-in.