The organisation's personal information holdings are documented
Context and Guidance: The organisation documents where (onshore or offshore) and how personal information is collected, processed, stored and transmitted as part of business activities. This might include business processes, IT systems, third party vendors, etc.