The personal data register is the record of processing, and it is the first thing looked at when data protection is reviewed. This one keeps a row per category of data and has room to say where AI tools touch it.
This register template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Register number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested register templates. No junk, jargon or unnecessary content. Simple and usable register templates
developed over 25 years through practical use in the real world.
Further guidance on personal data registers:
Download this register template with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This register is also included in the GDPR / Data Protection Toolkit and the ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22301, ISO 37001 and ISO 22458 toolkits, including the integrated toolkits that combine them, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help completing your personal data register and privacy notice, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Personal Data Register Template
A personal data register for documenting the personal data your organisation collects and holds, and serving as your record of processing activities (RoPA). Each row covers one category of personal data - who it is about, how it is processed and why, who it is shared with, where it is held and how it is protected, the lawful basis and how long it is kept.
The register is laid out on a single landscape page, with a lawful basis drop-down in each row, and is supplied in MS Word with a Google Docs version.
What's Included in this Personal Data Register
- Data Category - employee, customer, supplier and other categories
- Description of the Personal Data, who it is about, Processing operation and purpose - including a line on AI use where AI tools process the data
- Sharing / Transfer Details - recipients, processors including AI service providers, and transfers
- Where stored / held and Protection - systems, locations and security controls
- Lawful Basis - selected from a drop-down
- Retention - how long the data is kept, including copies held by providers
Which Personal Data Register?
The GDPR / Data Protection Toolkit offers several ways to keep the same record, and only one needs to be kept up to date:
- F-IMS24 Personal Data Register - organised by category of personal data, one row per category. The simplest option and the usual starting point.
- F-IMS30 Record of Processing Activities Register - organised by processing activity, and also records who is responsible and whether an impact assessment was needed. Suits organisations with more processing activities or responsibility spread across several people.
- ER21 Personal Data Register - the same information in Excel for filtering and sorting, with linked sheets for transfers, requests, breaches and deletions. The suggested option where special category data is processed.
- F-Q99 Record of Processing Form - one form for a single processing activity described in full. Useful for a complex or higher risk activity alongside any of the registers.
- F-IMS201 Records Register - all the records the company keeps, not only personal data. Useful for finding where personal data sits among everything else.
If a single combined document is preferred, the P-26 Privacy Policy can carry the record of processing as an appendix instead, with the same columns as F-IMS24.
Sample Data Versions for Subscribers
Two completed examples are available with an alphaZ subscription: a worked example of a typical register, and a second example with AI written into every row, showing which AI tools process each category, where AI is not permitted, and the personal data AI tools create in their own right.
Included in the GDPR / Data Protection Toolkit
This register is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download, and is also included in the ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22301, ISO 37001 and ISO 22458 toolkits.
Works with the Privacy Policy
Complete the register first, then write the P-26 Privacy Policy from it. The privacy notice points to the register by default, or can carry the same table as an appendix.
Related Documents
Other documents in the GDPR / Data Protection Toolkit that work alongside this one:
Would you rather we prepared it for you?
Our Personal Data Register and Privacy Notice Preparation service works through the personal data your organisation holds with you, including the AI tools in use, and prepares the register and privacy notice so they describe what actually happens to that data.
Personal Data Register and Privacy Notice Preparation