> For the complete documentation index, see [llms.txt](https://boza.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://boza.gitbook.io/docs/inventory/data.md).

# Data Inventory

Record the kinds of data your organization holds, how sensitive each one is, and which applications store or process it — the starting point for a GDPR record of processing or a NIS2 asset inventory.

{% hint style="info" %}
**Beta.** Data is available to workspace Admins from **Inventory → Data**. AI-drafted data types are a starting point for review, not a compliance record. Confirm each one before using the inventory as evidence.
{% endhint %}

***

## What a Data Type Records

A **data type** is a named family of data — customer records, payroll files, health records — not an individual field or document. Each one holds:

| Field                  | Meaning                                                                                                       |
| ---------------------- | ------------------------------------------------------------------------------------------------------------- |
| **Name**               | What the data is called in your organization. Required.                                                       |
| **Category**           | The business area it belongs to. Required.                                                                    |
| **Criticality**        | High, Medium, Low, or Unknown.                                                                                |
| **Privacy**            | Confidential, Internal, or Public.                                                                            |
| **Specificity**        | The frameworks it falls under, such as GDPR or SOC 2. Several can apply. Set from the data type's side panel. |
| **Description**        | Free text describing what the data covers.                                                                    |
| **Responsible person** | A user in your workspace who owns this data type.                                                             |
| **Applications**       | The tracked applications that hold or process it.                                                             |

***

## Build the Inventory in Two Steps

Boza confirms the structure before it links anything, so you review a short list of names rather than correcting hundreds of application links afterwards.

### Step 1 — draft and confirm the structure

1. Open **Inventory → Data** and click **Build my inventory**.
2. Answer the questionnaire. Only the first question is required:
   * which areas of your business handle data;
   * where data lives outside your applications, such as shared drives and inboxes;
   * how data moves in and out of the company;
   * special categories you handle, such as health, biometric, or judicial data;
   * the regulations or frameworks that apply to you;
   * documents that describe your data — a record of processing, an organization chart, or database schemas;
   * anything else worth knowing.
3. Click **Generate structure**. Boza drafts a list of data types with no applications attached and shows a **Step 1 of 2** banner above the table.
4. Review the draft. Rename, edit, add, or delete data types until the list matches reality.

**Expected result:** the table lists your data types, and the banner offers **Populate data**.

### Step 2 — link your applications

1. Click **Populate data** in the banner.
2. Boza links each data type to the tracked applications that hold it. This runs in the background — you can keep working while it fills in.

**Expected result:** the **Sensitivity** and **Map** tabs unlock, and each data type shows the applications behind it.

{% hint style="info" %}
Only applications Boza already tracks can be linked. If an application is missing from the result, check that it is tracked on the [Applications](/docs/inventory/applications.md) page.
{% endhint %}

***

## Read the Three Tabs

| Tab             | What it shows                                                                                                       |
| --------------- | ------------------------------------------------------------------------------------------------------------------- |
| **All Data**    | The full table of data types with their category, criticality, privacy, specificities, and linked applications      |
| **Sensitivity** | Confidential, personal, and regulated data grouped together; the summary cards also filter the list beneath them    |
| **Map**         | A data-type × application matrix, useful for spotting an application that touches more sensitive data than expected |

Use the search box and the **Filter** panel — criticality, privacy, and specificity — to scope all three tabs at once.

Click any data type to open its side panel, where you can edit its details, set the responsible person, and add or remove applications.

***

## Maintain the Inventory

| Action                              | Where                       | Effect                                                                                                                          |
| ----------------------------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| **Add new data**                    | Toolbar                     | A three-step form — **General info**, **Responsibility**, **Application** — so a new data type is never left half-described     |
| **Edit**                            | Data type side panel        | Corrects any field, including its specificities; an edited AI draft counts as reviewed                                          |
| **Update data list** (refresh icon) | Beside **Add new data**     | Describe changes in your own words — Boza's AI adds, edits, and removes accordingly. Anything you do not mention stays as it is |
| **Start over**                      | Inside **Update data list** | Retakes the questionnaire and replaces the whole structure                                                                      |
| **Delete**                          | Data type side panel        | Removes the data type and its application links                                                                                 |

{% hint style="warning" %}
**Update data list** can delete data types, and **Start over** replaces the entire structure. Both ask you to confirm before they run, and neither can be undone from the interface.
{% endhint %}

***

## Best Practices

* **Confirm the structure before populating.** A short list of names is far quicker to correct than hundreds of application links.
* **Name a responsible person** for every confidential or regulated data type, so an audit request has an owner.
* **Attach your documents** in the questionnaire. A record of processing or a database schema gives the draft real vocabulary instead of generic categories.
* **Re-check after adding applications.** New tools do not link themselves. Add them from a data type's side panel, or ask for them in **Update data list**.
* **Treat the draft as a draft.** Review every AI-generated data type before the inventory is used as compliance evidence.

***

## Related Guides

* [Applications](/docs/inventory/applications.md)
* [App Detail Page](/docs/inventory/applications/app-detail.md)
* [Business Capability Map](/docs/platform/mapping.md)
* [Data Privacy & GDPR](/docs/settings-and-security/data-privacy-gdpr.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://boza.gitbook.io/docs/inventory/data.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.