Build the data inventory that a subject access request needs

applied · 80 min · Objective 3.3

Task

Produce a data inventory for a small synthetic estate, then answer two questions against it that are impossible without one: where is all of this person's data, and what would a breach of this store actually expose.

Steps

  1. Create a synthetic estate: four stores in different formats — a CSV export, a small SQLite database, a directory of documents, and a log file — with one synthetic individual's identifier appearing in three of them and not the fourth.
  2. Build /tmp/inventory.csv with the columns store,location,data_types,classification,owner,retention,lawful_basis.
  3. Answer the first question with a script rather than by memory: /tmp/find-subject.sh <identifier> must search every store named in the inventory and report which ones hold the subject's data.
  4. Verify it against the truth you constructed: three stores, not four.
  5. Now answer the second question: for each store, write what a breach of it would expose, and which notification obligations would follow from that content.
  6. Note the store where retention had expired and the data should already have been deleted — build one into the estate deliberately.

Verify

awk -F, 'NR>1 && NF>=7 {n++} END {print n" store(s) inventoried"}' /tmp/inventory.csv
bash /tmp/find-subject.sh SUBJ-0001 | grep -c "found in"
python3 - <<'PY'
import csv,subprocess
inv=list(csv.DictReader(open('/tmp/inventory.csv')))
assert len(inv)>=4, 'fewer than four stores'
out=subprocess.run(['bash','/tmp/find-subject.sh','SUBJ-0001'],
                   capture_output=True,text=True).stdout
hits=out.lower().count('found in')
print('subject located in',hits,'store(s)')
assert hits==3, 'expected exactly three - the search is missing a store or matching the wrong one'
for r in inv:
    assert r['retention'].strip(), 'no retention period for '+r['store']
print('every store has a retention period')
PY

The assertion that the subject is found in exactly three stores is the real test. Two means the search misses a format — usually the database or the documents — and four means it is matching something it should not. Either way the inventory could not answer an access request correctly, which is the obligation it exists to serve.

Notes

The store whose retention had expired is the finding worth keeping. Most organisations discover during a subject access request that they hold data they should have deleted years ago, and the request forces them to disclose it — which is the practical argument for data minimisation over better protection.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.