Special category and criminal offence data needs more than a basic record of processing. This workbook has room for it, with sheets for transfers, requests, breaches and deletions.

Effective Excel Registers

Part of the alphaZ ER series of Excel registers, built for listings that grow and need to be sorted and filtered. Supplied in fully editable MS Excel format with all text in Calibri font for improved readability.
The register is set up with:

• Drop-down input lists so entries stay consistent
• Linked sheets for transfers, requests, breaches and deletions
• Filters to sort and show the listing by category

alphaZ documents - tried and tested registers with no junk, jargon or unnecessary columns, developed over 25 years through practical use in the real world.

Further Reading

Further guidance on personal data registers:

• Data Protection and UK GDPR
• Personnel Records and Data Protection
• ISO 42001 Annex A.7 - Data for AI Systems
• Legal and Compliance knowledge base

How to Download

This file is included in the alphaZ subscription. This register is also included in the GDPR / Data Protection Toolkit, so the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like hands-on help completing your personal data register and privacy notice, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Personal Data Register Template in Excel

An Excel personal data register for summarising the personal data your organisation collects, holds and processes. It is your record of processing activities (RoPA), with linked sheets for data transfers, subject access requests, data breaches and a data deletion schedule, and a summary sheet that can be copied into a privacy notice.

Input lists control data entry on the key sheets, so entries stay consistent and can be filtered and looked up.

What's Included in this Register

• Personal-Data-Register - each entry records the data category, the personal data and processing, sharing and transfers, where it is held and how it is protected, lawful basis, responsibility, data subject rights, retention and disposal, special category (SC) or criminal offence (CO) status, impact assessment status, and AI use with the AI tool and provider
• Data-Transfers - details of each transfer, the security arrangements, and the agreement and transfer safeguard
• Access-Requests - requests received, the rights involved and the response
• Data-Breach-Register - breach details, containment, risk rating and whether it is reportable
• Data-Deletion-Schedule - data due for deletion or archiving
• DPP-Output - a summary of the register, including AI use, ready to copy into a privacy notice
• Instructions - how to complete the workbook and the input lists behind the drop-downs

Which Personal Data Register?

The GDPR / Data Protection Toolkit offers several ways to keep the same record, and only one needs to be kept up to date:

• F-IMS24 Personal Data Register - organised by category of personal data, one row per category. The simplest option and the usual starting point.
• F-IMS30 Record of Processing Activities Register - organised by processing activity, and also records who is responsible and whether an impact assessment was needed. Suits organisations with more processing activities or responsibility spread across several people.
• ER21 Personal Data Register - the same information in Excel for filtering and sorting, with linked sheets for transfers, requests, breaches and deletions. The suggested option where special category data is processed.
• F-Q99 Record of Processing Form - one form for a single processing activity described in full. Useful for a complex or higher risk activity alongside any of the registers.
• F-IMS201 Records Register - all the records the company keeps, not only personal data. Useful for finding where personal data sits among everything else.

If a single combined document is preferred, the P-26 Privacy Policy can carry the record of processing as an appendix instead, with the same columns as F-IMS24.

Included in the GDPR / Data Protection Toolkit

This register is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download.

Works with the Data Protection Impact Assessment

Where an entry needs an impact assessment, the register prompts for it and the assessment can be completed on the F-Q97 Data Protection Impact Assessment.