The breach began with a name. Then an email. Then an address. Each piece was Personal Identifiable Information—PII—falling out of a system that had no proper catalog. Under GDPR, this is not just a mistake. It is a violation with consequences.
A GDPR PII catalog is the structured record of all personal data your organization collects, processes, stores, and shares. Done right, it maps every data element to its source, its storage location, its lawful basis for processing, and its retention period. It is the cornerstone of compliance, and without it you cannot respond quickly to subject access requests or prove lawful handling to regulators.
Building a GDPR PII catalog requires more than listing columns in a database. It means identifying all data flows. Web forms. Internal APIs. Third-party integrations. File exports. Backups. Logs. Each place where personal data appears must be tracked. For GDPR compliance, the catalog must also classify data fields according to their sensitivity: names, national identification numbers, IP addresses, biometric markers, location data, and user-generated content.