Update Details: An AI version of the F-IMS24 Personal Data Register has been added to the Sample Data Files, showing how a Record of Processing Activities is completed where AI systems process personal data.
The existing sample data for the F-IMS24 Personal Data Register was written for a company that does not use AI tools. The AI version keeps the same layout and the same data categories, and works the AI position into the existing columns rather than adding a new one. It is fully editable and is there as a worked example to copy from and amend. It refers to approved AI systems, the AI policy and the AI impact assessment rather than to named documents, so it can be used alongside any set of AI records.
AI icons carried across from the business risk assessments
The register uses the icons from the business risk icon set, built to accompany the F-Q36 General Risk Assessment. The orange AI hexagon marks a row that an AI system processes and the red prohibition ring marks data that must not be entered into AI tools. A row with no symbol is a row where AI is not in use. The AI position on the register can therefore be read at a glance rather than by working through every description. A note at the head of the register explains the symbols and the AI use line, so anyone picking the document up knows how to read it and anyone completing their own copy knows what the marks are for.
What the F-IMS24 AI version covers
- An AI use line on every row - each description ends with a statement of what AI does with that data, what it is not allowed to decide, and who checks the output before it is used
- Where AI is barred - photo-ID and right to work documents, screening and DBS checks, payroll and bank details, health data and CCTV footage are all marked as data that must not be entered into AI tools
- Where AI is used - the email assistant, the meeting note-taker, CV screening, lead scoring and vehicle route planning are marked on each of the rows they affect
- Sharing details - AI providers named as processors under contract on every row they touch, with screening, payroll and licence checking providers asked to confirm in writing whether any part of their service uses AI
- Storage details - HR and payroll folders marked as excluded from AI indexing, and assistants stated to run only under the individual user's own login, so an AI tool sees only what that user can already see
- Retention periods - defined periods with the AI copy covered separately: provider prompt logs 30 days, chatbot logs 90 days, transcripts and summaries 12 months, meeting recordings deleted once the minutes are approved, and AI drafts deleted once the final document is filed
- Three new rows - AI assistant prompts and outputs, meeting recordings and AI transcripts, and website chatbot conversation logs, all of which are personal data that only exists because AI is in use
- Lawful basis notes - a candidate may object to AI assisted screening and ask to be assessed manually, and consent is recorded where AI analytics rely on non-essential cookies
File added on the following page;
The Sample Data Files page is available to alphaZ subscribers.
Further guidance is available in our knowledge base article;
Data Protection and UK GDPR
