Why do we need to fill out the Data Inventory Google Sheet?

The sheet helps us maintain a comprehensive record of systems and their data elements, ensuring proper management and protection of information. It's a crucial step in our commitment to data privacy and security.

Who should fill out the Data Inventory Google Sheet?

The individuals responsible for the systems should complete the sheet. Usually, this may include IT system owners or designated representatives.

What if the primary purpose of a system doesn't fit the provided options?

Use the If other, please describe field to provide a brief description of the system's purpose.

How do I estimate expected expenses for privacy and security updates?

The MD Higher Ed Privacy Law requires that we evaluate and document the technical and financial feasibility of implementing privacy controls and services within the system. We've chosen to interpret this as expense of privacy and security updates (as cost is what would also drive technical feasibility). This evaluation does not require exact implementation plans, and it does not require precise budgeting numbers - provide your best (broad) estimate of whether updates would be cheap/easy (low/no cost), budget-busting or impossible (high cost), or somewhere in between (moderate). In performing this evaluation, you might consider: 

• The system's age.
• Its complexity (was it developed at UMD? Has it been customized?).
• Its expense.
• The number of people needed to support it.
• The number of people that use it.

Top

What types of data should I include in the "Type of Data in System" section?

Some types of data have been pre-entered into the sheet.

• If your data fits within one of those categories, select it.
• If your data is different from what is in the drop-down on the sheet, simply select Other and describe your data type in the following column.

How do I handle systems with multiple data types?

If a system contains multiple data types, mark Y for Multiple Data Types. Use the Additional Data Types sheet to provide details about each type. Make sure the Name of System matches on both sheets.

What if I don't know the data retention schedule for a system?

That's fine. This column is only intended to measure awareness of data retention at UMD. No is a perfectly acceptable answer.

What if I use a central system (Google Drive or Box for example)?

Provide the name of the service (in Column A), and collect and provide the information related to the types of data you have and the reasons you have or use it (Columns M-U). You may ignore columns B-L.

What if I operate a system that others use?

If you use the system yourself, document the primary purpose you use the system for, and note in column E This system is also administered on behalf of other departments. If you do not use the system, do the same, but you may ignore Columns M-U.

Top

What is a System of Record?

A system of record is the source of truth for information about a person, regardless of whether the System of Record is managed by DIT, another division, a college, or a department.  

For example, if a college or department developed an application that tracks the progress of graduate students in their unit and creates additional information not in campuswide systems (such as advisors’ comments), that application would be a System of Record that needs to be included, because it is the only official record of those comments.

The data I manage is sensitive, are you asking us to put our data in this Google Sheet?

No, this inventory will include information about what is stored and where (called metadata), but not any of the actual data stored in the Systems of Record.

Top

Data Inventory Template

Click for access to the Data Inventory Template.