Entity maintains an inventory of categories of personal information collected along with its usage, sources and specific purposes for collection as per regulatory requirements (“Record of Processing Activities”) and reviews it on an annual basis