# Personal data asset register checklist

Use this to build or check a register of every system that stores or moves personal data. Every store of
personal data, and every conduit for it, needs an owner, a classification, a retention rule and a place in
the dataflow that a rights request can reach. The fields follow ISACA's CDPSE exam content outline
(2025): data inventory, dataflow diagrams and classification; persistence and destruction; and privacy
and security controls.

## For each asset (database, bucket, log, SaaS tool, API, device fleet)

- [ ] Name and owner (a person, not a team): ____________
- [ ] Classification of the personal data it holds
- [ ] Which fields of personal data it holds, and the purpose for each
- [ ] Where it sits in the dataflow diagram: what feeds it, what it feeds
- [ ] Retention rule, and the job or process that enforces it
- [ ] How data is destroyed at the end of retention, and how that is evidenced
- [ ] Regions where it is stored or processed (for transfer analysis)
- [ ] Access control: who can read it, who granted that, when it was last reviewed
- [ ] Encryption at rest and in transit; hashing or pseudonymization where used
- [ ] Logging and monitoring of access
- [ ] Whether a rights request (access, deletion, correction) can reach it, and how

## When something changes

- [ ] A new field: update what personal data the asset holds
- [ ] A new integration: update the dataflow
- [ ] A new region: update the transfer analysis
- [ ] A new vendor or processor: assess it before data flows, and record the assessment

## If an exposure is found

- [ ] Contain it first: restrict access before documenting, assessing or deciding retention
- [ ] Then record what happened, assess the impact and follow the incident process