A privacy notice is only as good as the register behind it. The personal data register (RoPA) should describe current personal data processing activities and the policy should share this information.

Further Reading

Further guidance on personal data and AI:

• Data Protection and UK GDPR
• Personnel Records and Data Protection
• ISO 42001 Annex A.7 - Data for AI Systems
• Legal and Compliance Knowledge Base

Prefer to Do It Yourself?

The F-IMS24 Personal Data Register in Word, the ER21 Personal Data Register in Excel, the P-26 Privacy Policy and the P-84 Website Privacy Policy are all on the shelf, and Document Preparation will put your company name and logo on them.

Personal Data Register and Privacy Notice Preparation

Every organisation that holds personal data needs to know what it holds, why it holds it, where it is kept and who it is shared with, and to explain that clearly to the people it belongs to. The personal data register - your record of processing activities, or RoPA - records the first part, and your privacy notices share it. Prepared together, they describe the same business and give anyone who asks a clear and consistent answer.

This service prepares both for you. We build the register first, with the AI tools your people use written into every activity they touch, and then write your privacy notices from it so the two always match. Our article Does Your Personal Data Register Consider AI? shows the approach row by row.

Why You Need One

• It is what data protection law expects - most organisations are expected to keep a record of the personal data they process, and to tell people clearly how it is used
• Your privacy notices are only as clear as the register behind them - the notice tells candidates, clients and staff what the register records, so a well prepared register makes the notice easy to write and easy to keep right
• It answers questions quickly - a subject access request, a client's supplier questionnaire or a question from a candidate can be answered from one place, because you know where every piece of personal data sits
• It lets you use AI with confidence - AI tools used on personal data are processing like any other, and recording them in the register means you can tell people how AI is used and show that the right safeguards are in place
• It supports a management system - for ISO 27001 and ISO 42001 it is part of the evidence that personal data is identified and protected

What You Get

• Your personal data register completed - the F-IMS24 Personal Data Register in Word or the ER21 Personal Data Register in Excel, whichever you would rather work in. Each processing activity with its purpose, lawful basis, where the data is kept, who it is shared with and how long it is kept. This is your record of processing activities, or RoPA
• AI written into every row it touches - which tools can reach that data, which providers that makes processors, and what each provider keeps of prompts, transcripts and chat logs
• Rows for the records AI creates - prompts and outputs, meeting recordings, transcripts and summaries, website chatbot conversations and anything else your tools generate that holds personal data
• Decisions made by software flagged - wherever a tool scores, ranks or filters people, the row says so and records who reviews the outcome and how someone can challenge it. Screening job applicants is the obvious case
• Rows where AI is not permitted recorded - so the register shows that AI was considered for that data and a decision made
• Your privacy notices rewritten from the register - the P-26 Privacy Policy for the people whose data you hold and the P-84 Website Privacy Policy for your site, with separate notices where different people need different ones, such as candidates, clients and staff. If your policy set is being reset at the same time, the notice is written once, here
• Next steps identified - where a provider needs a processing agreement or an activity needs a data protection impact assessment, it is marked for you, with the F-Q21 Data Transfer and Processing Agreement and the F-Q97 Data Protection Impact Assessment as the documents that cover them

How Much One Day Covers

The register and the notices, for most organisations. There is no cap on the number of rows. What moves the time is how many groups of people you hold data on and how many systems it passes through - a recruitment business with a candidate database, job boards, a screening tool and a payroll provider is a bigger job than a consultancy with one client list. The more context and information you give us, the better what we prepare will be. We work through as much as the time allows, in the order that matters most to you.

How the Work Gets Done

We use our own AI tooling to do the mechanical part of document preparation, and a consultant checks the output before it reaches you. On a personal data register the tooling does the cross-referencing - carrying each tool from your list into every row it touches, checking that every provider who can see the data appears in the sharing column, and drafting the notices from the register so they describe the same processing.

Which lawful basis a row rests on, how long something should be kept, and whether a tool is supporting a decision or making it are judgements, and they are made by a consultant with you. That is what makes the register an accurate record of how your business handles personal data.

The templates are ours, developed over 25 years of real audits, and they are not AI generated. Every entry comes from what you tell us about your business, and anything we need to confirm comes back as a question in the covering notes, so the finished register is one you can stand behind.

Why a Day Goes This Far

Anyone can rent the same AI we use. What they cannot rent is what we point it at.

Behind this service is a document library built over 25 years - manuals, procedures, policies, registers, risk assessments, COSHH assessments, audit checklists and forms, covering every standard we work to and most situations a management system runs into. Each one has been through real audits, and corrected where an assessor pushed back. That is the part that took 25 years, and it is the part that cannot be generated.

Our tooling applies that library to your business. A general purpose AI, pointed at the same job, has nothing to apply, so it writes something that reads well and describes a company that does not exist.

What We Need From You

• Whose personal data you hold - candidates, clients, staff, suppliers, website visitors - and roughly what about each
• Every AI tool in use, including the free ones people use without asking, and which accounts or subscriptions they sit under
• Any software that scores, ranks or filters people
• Where the data is kept and who it is shared with, including agencies, platforms and service providers
• Your current privacy notices and any existing register or RoPA
• How long you keep things, where you have decided

Alongside Your AI Risk Register

Most AI risk sits on personal data. The AI Policy and Risk Register service sets out which AI tools you use, what could go wrong with each and what AI is not permitted to do. The two share one list of tools, so what your AI register says you use and what your personal data register says you share cannot drift apart. The F-AI2 AI Data Matrix is the bridge between them.

Keeping It Current

A personal data register is most useful when it keeps pace with the business. It is set up to be reviewed whenever a tool is added, changed or retired, and whenever you start collecting something new, and the notices are updated from it at the same time. Remote Support - Ongoing covers keeping it current alongside the rest of your system.

What This Does Not Cover

It is not legal advice. Where a question turns on how the law applies to a specific activity, take advice on that matter. It records your arrangements but does not verify that they are working - that is what internal audit and management review are for. Data protection impact assessments and processing agreements are flagged rather than written in the same day, and we record what an AI provider says it keeps rather than testing it.

Other Things Remote Support Covers

A support day does not have to be spent on your personal data register. The same day can be pointed at any one of these instead, and it is the same purchase either way:

• Enhanced IMS Setup - the whole file set branded and set up
• IMS Manual and Registers Preparation - the manual written and the registers completed
• Risk Assessment Reformatting and Hazard Register - your existing assessments in one format and indexed
• COSHH Assessment Preparation - existing COSHH reworked, or built from your safety data sheets
• Legal Register Preparation - your legal register and its written summary
• Environmental Registers and Aspects Assessment - aspects and impacts, life cycle review and a carbon management plan
• Information Security Risk and Treatment Plan - assets, risks, treatment and the Statement of Applicability
• AI Policy and Risk Register - your AI tools, the risks and controls against each, and what AI may not do
• Business Risk Assessment Preparation - risk to the business rather than to the person doing the task
• Company Forms, Policies and HR Reset - your policy set, staff handbook and HR forms as one branded set
• Internal Audit Training and Support - your people trained and your audit programme set up
• Full Clause Conversion Service - an existing clause-based system rebuilt around your business processes
• Constructionline, SSIP and CAS Application Support - an application completed with the evidence behind it

A day can also go on things that are not document preparation at all - training, internal audits, a gap analysis, or simply working through a problem on a call. Remote Support - Project is the same day bought without a job attached to it.