A privacy notice is only as good as the register behind it. The personal data register (RoPA) should describe current personal data processing activities and the policy should share this information.
Further guidance on personal data and AI:
Personal Data Register and Privacy Notice Preparation
Every organisation that holds personal data needs to know what it holds, why it holds it, where it is kept and who it is shared with, and to explain that clearly to the people it belongs to. The personal data register - your record of processing activities, or RoPA - records the first part, and your privacy notices share it. Prepared together, they describe the same business and give anyone who asks a clear and consistent answer.
This service prepares both for you. We build the register first, with the AI tools your people use written into every activity they touch, and then write your privacy notices from it so the two always match. Our article Does Your Personal Data Register Consider AI? shows the approach row by row.
Why You Need One
- It is what data protection law expects - most organisations are expected to keep a record of the personal data they process, and to tell people clearly how it is used
- Your privacy notices are only as clear as the register behind them - the notice tells candidates, clients and staff what the register records, so a well prepared register makes the notice easy to write and easy to keep right
- It answers questions quickly - a subject access request, a client's supplier questionnaire or a question from a candidate can be answered from one place, because you know where every piece of personal data sits
- It lets you use AI with confidence - AI tools used on personal data are processing like any other, and recording them in the register means you can tell people how AI is used and show that the right safeguards are in place
- It supports a management system - for ISO 27001 and ISO 42001 it is part of the evidence that personal data is identified and protected
What You Get
- Your personal data register completed - the F-IMS24 Personal Data Register in Word or the ER21 Personal Data Register in Excel, whichever you would rather work in. Each processing activity with its purpose, lawful basis, where the data is kept, who it is shared with and how long it is kept. This is your record of processing activities, or RoPA
- AI written into every row it touches - which tools can reach that data, which providers that makes processors, and what each provider keeps of prompts, transcripts and chat logs
- Rows for the records AI creates - prompts and outputs, meeting recordings, transcripts and summaries, website chatbot conversations and anything else your tools generate that holds personal data
- Decisions made by software flagged - wherever a tool scores, ranks or filters people, the row says so and records who reviews the outcome and how someone can challenge it. Screening job applicants is the obvious case
- Rows where AI is not permitted recorded - so the register shows that AI was considered for that data and a decision made
- Your privacy notices rewritten from the register - the P-26 Privacy Policy for the people whose data you hold and the P-84 Website Privacy Policy for your site, with separate notices where different people need different ones, such as candidates, clients and staff. If your policy set is being reset at the same time, the notice is written once, here
- Next steps identified - where a provider needs a processing agreement or an activity needs a data protection impact assessment, it is marked for you, with the F-Q21 Data Transfer and Processing Agreement and the F-Q97 Data Protection Impact Assessment as the documents that cover them
How Much One Day Covers
The register and the notices, for most organisations. There is no cap on the number of rows. What moves the time is how many groups of people you hold data on and how many systems it passes through - a recruitment business with a candidate database, job boards, a screening tool and a payroll provider is a bigger job than a consultancy with one client list. The more context and information you give us, the better what we prepare will be. We work through as much as the time allows, in the order that matters most to you.
How the Work Gets Done
We use our own AI tooling to do the mechanical part of document preparation, and a consultant checks the output before it reaches you. On a personal data register the tooling does the cross-referencing - carrying each tool from your list into every row it touches, checking that every provider who can see the data appears in the sharing column, and drafting the notices from the register so they describe the same processing.
Which lawful basis a row rests on, how long something should be kept, and whether a tool is supporting a decision or making it are judgements, and they are made by a consultant with you. That is what makes the register an accurate record of how your business handles personal data.
The templates are ours, developed over 25 years of real audits, and they are not AI generated. Every entry comes from what you tell us about your business, and anything we need to confirm comes back as a question in the covering notes, so the finished register is one you can stand behind.
Why a Day Goes This Far
Anyone can rent the same AI we use. What they cannot rent is what we point it at.
Behind this service is a document library built over 25 years - manuals, procedures, policies, registers, risk assessments, COSHH assessments, audit checklists and forms, covering every standard we work to and most situations a management system runs into. Each one has been through real audits, and corrected where an assessor pushed back. That is the part that took 25 years, and it is the part that cannot be generated.
Our tooling applies that library to your business. A general purpose AI, pointed at the same job, has nothing to apply, so it writes something that reads well and describes a company that does not exist.
What We Need From You
- Whose personal data you hold - candidates, clients, staff, suppliers, website visitors - and roughly what about each
- Every AI tool in use, including the free ones people use without asking, and which accounts or subscriptions they sit under
- Any software that scores, ranks or filters people
- Where the data is kept and who it is shared with, including agencies, platforms and service providers
- Your current privacy notices and any existing register or RoPA
- How long you keep things, where you have decided
Alongside Your AI Risk Register
Most AI risk sits on personal data. The AI Policy and Risk Register service sets out which AI tools you use, what could go wrong with each and what AI is not permitted to do. The two share one list of tools, so what your AI register says you use and what your personal data register says you share cannot drift apart. The F-AI2 AI Data Matrix is the bridge between them.
Keeping It Current
A personal data register is most useful when it keeps pace with the business. It is set up to be reviewed whenever a tool is added, changed or retired, and whenever you start collecting something new, and the notices are updated from it at the same time. Remote Support - Ongoing covers keeping it current alongside the rest of your system.
What This Does Not Cover
It is not legal advice. Where a question turns on how the law applies to a specific activity, take advice on that matter. It records your arrangements but does not verify that they are working - that is what internal audit and management review are for. Data protection impact assessments and processing agreements are flagged rather than written in the same day, and we record what an AI provider says it keeps rather than testing it.
Other Things Remote Support Covers
A support day does not have to be spent on your personal data register. The same day can be pointed at any one of these instead, and it is the same purchase either way:
A day can also go on things that are not document preparation at all - training, internal audits, a gap analysis, or simply working through a problem on a call. Remote Support - Project is the same day bought without a job attached to it.