---
title: "Build a personal-information inventory from the systems the client names"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-record-of-processing-from-the-interviews-and-system-list/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-A20260923-1-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Build a personal-information inventory from the systems the client names

> From the system list and interviews the lawyer supplies, record the category, the purpose, whether the client says the information is sold or shared, and the stated retention.…

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-record-of-processing-from-the-interviews-and-system-list/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the system list and interviews the lawyer supplies, record the category, the purpose, whether the client says the information is sold or shared, and the stated retention. Decide nothing about whether the notice is lawful. |
| What the lawyer must review | Civil Code section 1798.100 requires a business that controls collection to tell the consumer, at or before collection, the categories, the purposes, whether the information is sold or shared, the sensitive-information categories where relevant, and the retention period or the criteria used to set it. Collection must be reasonably necessary and proportionate to the disclosed purpose. The inventory is the factual list those duties are checked against. It is not a GDPR record of processing, and it is not the notice. Opinion 512 and Model Rule 1.6: the inventory holds client and consumer information. |
| Written for | United States |
| Applies to | [Build a record of processing from the interviews and system list](https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-record-of-processing-from-the-interviews-and-system-list.md) |

## Checking plan

- What the AI does: From the system list and interviews the lawyer supplies, record the category, the purpose, whether the client says the information is sold or shared, and the stated retention. Decide nothing about whether the notice is lawful.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- Only a business covered by the CCPA has these duties. Open section 1798.140 before you treat the client as one.
- Other state privacy statutes ask for different inventories. California is the opened example.

## Sources

- [California Civil Code section 1798.100 (duties of businesses that collect personal information)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100.) (checked 2026-10-22)
- [California Attorney General: California Consumer Privacy Act (CCPA)](https://oag.ca.gov/privacy/ccpa) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*