How to Build a Personal Data Register for Your Business

Most businesses know they have personal information. The more difficult question is: do you know exactly what personal information you have, why you have it, where it is stored, who can access it, who receives it and how long you keep it?

A Personal Data Register helps you answer those questions. It creates a structured inventory of the personal-data processing activities taking place throughout your organisation.

You may also hear this type of record described internationally as a Record of Processing Activities (ROPA). For Jamaica Privacy Hub, we use the more accessible term Personal Data Register.

What should your Personal Data Register contain?

For each processing activity, document:

• the activity being performed;
• categories of individuals involved;
• personal data being processed;
• sensitive personal data involved;
• purpose of processing;
• source of the information;
• where it is stored;
• who has access;
• organisations it is shared with;
• processors involved;
• whether it leaves Jamaica;
• how long it is retained;
• how it is disposed of; and
• security measures protecting it.

Think in activities, not databases

Do not simply write "Customer database." Instead, identify the business activities.

For example, Customer Registration may collect:

• name;
• address;
• telephone number;
• email address; and
• identification information.

You should then document why each category is needed.

Another activity might be Employee Payroll, which may involve:

• employee names;
• TRNs;
• bank details;
• salaries;
• deductions; and
• employment information.

The payroll provider may also be a processor.

Why is this important?

A Personal Data Register helps your organisation understand its actual data environment. It can support:

• preparation of registration information;
• privacy notices;
• DPIAs;
• retention schedules;
• processor management;
• breach investigations;
• data-subject requests;
• risk assessments; and
• compliance reviews.

Start small

You do not have to map the entire organisation in one sitting. Start with the most obvious activities:

1. Customers
2. Employees
3. Suppliers
4. Website
5. Payments
6. Marketing
7. CCTV
8. Accounting

Then expand the register as you identify additional activities.

Jamaica Privacy Hub can help

Use the Personal Data Register to document each activity through a guided questionnaire. Information entered once can inform your privacy notices, DPIAs, retention schedule and more.