Information Asset Register: A GDPR Guide for Small Firms

Your business holds more information than you might think: customer lists, invoices, staff records, supplier contacts, years of emails and a few backups nobody has looked at in ages. An information asset register is simply a list of all of it, with notes on where it lives, who looks after it and why you keep it. For small firms in the UK and EU, it is also the most practical way to get on top of GDPR.

The word DATA stenciled in large letters on a wall, with paint marks around the letters — Data is a business asset like any other, and it deserves its own register.

Key takeaways

An information asset register lists the information your business holds, with its owner, location, type of personal data, purpose, lawful basis, sharing, retention period and security.
Article 30 of the UK GDPR and EU GDPR requires records of processing activities, and the small business exemption is narrower than most people expect.
Most small businesses that process personal data regularly, such as customer or staff records, should keep these records.
Start with a spreadsheet, use the ICO's published templates as a guide and review the register at least once a year.

Searches for "data asset register" have grown over the past year, according to Google Trends. Many small business owners have heard that they need "some sort of GDPR record" but are not sure what it should look like or where to begin.

This guide keeps it practical. You will learn what an information asset register is, how it links to your GDPR record-keeping duties, which columns to include, how to build your first version in a few short sessions and how to keep it useful afterward. It is general information, not legal advice, so check the current guidance from your data protection regulator for your situation.

What an information asset register is

An information asset register is an inventory of the information your business holds. Think of it as the data version of a fixed asset register. Instead of listing laptops and vans, you list things like:

Customer lists and contact details
Employee records, including contracts and payroll details
Supplier and contractor data
Email accounts and shared inboxes
Invoices, quotes and order history
Website form submissions and newsletter sign-ups
Backups, archives and old exports

For each item, you record a few key facts: who owns it, where it is stored, what kind of personal data it contains, why you hold it, the lawful basis for using it, who you share it with, how long you keep it and how you protect it.

The result is a single place where you can answer questions like "Where do we keep customer phone numbers?" or "Who else gets a copy of our payroll data?" without hunting through folders and apps.

Pro tip

Think in terms of "data sets," not individual files. "Customer orders in our online shop" is one asset. "Each order confirmation email" is not. Grouping data this way keeps the register short enough to stay useful.

How it connects to GDPR record keeping

Under both the UK GDPR and the EU GDPR, Article 30 requires organizations to keep records of processing activities. These records describe what personal data you process, why, who it is shared with, how long you keep it and how you keep it secure. An information asset register is a natural way to hold that information.

The small business exemption is narrow

Many people believe that firms with fewer than 250 employees do not need these records at all. That is not quite right. Organizations with fewer than 250 employees are exempt only if their processing is occasional, unlikely to result in a risk to people's rights and freedoms, and does not include special category data (such as health information) or criminal offense data.

In practice, most small businesses process personal data regularly. Running payroll, keeping a customer database or sending a monthly newsletter are not occasional activities. So most small businesses that process personal data regularly should keep records, at least for those regular activities.

Common mistake

Assuming "we are too small for GDPR paperwork." Size alone does not get you out of record keeping. If you hold staff records or a customer list you use every week, you are processing personal data regularly, and a simple register is the sensible way to show you understand what you hold.

Where to find help

In the UK, the Information Commissioner's Office (ICO) publishes guidance and templates for records of processing activities, including versions aimed at smaller organizations. EU countries each have their own data protection authority, many of which publish similar guidance. Use these as your starting point, and adapt them to your business.

What to include: the core columns

You do not need a complicated system. A spreadsheet with these columns covers the essentials:

Asset name: a short, clear label, such as "Customer database" or "Payroll records."
Owner: the person responsible for this data, usually by role, such as "Office manager."
Location or system: where the data lives, such as an accounting app, a shared drive, a filing cabinet or an email account.
Type of personal data: names, contact details, bank details, health information and so on. Flag any special category data clearly.
Whose data: customers, employees, suppliers, website visitors.
Purpose: why you hold it, such as delivering orders, paying staff or sending marketing emails.
Lawful basis: the GDPR basis you rely on, such as contract, legal obligation, consent or legitimate interests.
Shared with: other organizations that receive the data, such as a payroll provider, an accountant or a delivery company.
Retention period: how long you keep it and what happens afterward.
Security measures: how it is protected, such as passwords, two-factor login, encryption, a locked cabinet or restricted access.

A copyable register template

Copy this into a spreadsheet and add a row for each data set. The entries below are made-up examples for a small design studio; your own will differ.

Asset	Owner	Location	Personal data	Purpose	Lawful basis	Shared with	Retention	Security
Client contacts	Studio manager	CRM app	Names, emails, phone numbers	Managing projects	Contract	None	Example: 2 years after last project	Two-factor login, staff access only
Payroll records	Owner	Payroll software	Names, addresses, bank details, tax numbers	Paying staff	Legal obligation, contract	Accountant	As required by tax rules	Owner access only, strong password
Newsletter list	Marketing lead	Email marketing tool	Names, emails	Sending updates	Consent	Email tool provider	Until unsubscribe	Two-factor login

Shelves filled with rows of colorful binders and folders, neatly arranged in an office — Paper files count too: list the binders and folders that hold personal data, not just your apps.

Build your first register in five steps

You can create a solid first version in two or three short sessions. Do not aim for perfection; aim for a complete, honest list you can improve.

Walk through your business. List every app, system, drive, inbox and filing cabinet you use. Include phones and laptops that hold work data, and any old backups.
Follow the data. For each place, ask what personal data is in it, where it came from and where it goes next. Think about the journey of a customer from enquiry to invoice, and of an employee from hiring to leaving.
Fill in the columns. Add a row per data set. If you are unsure about something, such as the lawful basis, write "to check" rather than guessing.
Assign owners. Give each asset a named role responsible for keeping it accurate and secure. In a one-person business, that is you, which is fine.
Fix the gaps you find. Old exports nobody needs, shared logins, data with no clear purpose: make a short to-do list and work through it.

Hypothetical example

Imagine Amira, who runs a small physiotherapy clinic with four staff. While building her register, she finds patient notes in the booking system, appointment reminders in a separate messaging tool and an old spreadsheet export on a former employee's laptop. Because health information is special category data, she marks those rows clearly, deletes the old export, turns on two-factor login for the booking system and checks her retention period against her professional body's guidance. One afternoon of listing gives her a clear picture and a short list of real improvements.

Keeping the register useful

A register is only valuable if it reflects how your business works today. A few simple habits keep it current:

Review it at least once a year. Put a date in your calendar and check every row with the asset owners.
Update it when things change. New software, a new supplier, a new service or a new type of customer data should trigger a quick update.
Use it for subject access requests. When someone asks what data you hold about them, the register tells you exactly where to look.
Use it after a security incident. If a laptop is lost or an account is compromised, the register shows what data might be affected.
Link it to your retention schedule. When the retention period ends, delete or anonymize the data and record that you did.
Connect it to your other records. If you keep a fixed asset register for equipment, cross-reference devices that store personal data so you remember to wipe them before disposal.

Pro tip

Add a "Last reviewed" column with a date for each row. At a glance you can see which assets have not been checked in a while, and it shows a regulator or client that you look after your records actively.

Your information asset register checklist

List every app, drive, inbox, device and filing cabinet that holds business data
Group the data into clear data sets, one row each
Record owner, location, personal data type and whose data it is
Note the purpose and lawful basis for each data set
Record who you share data with and how long you keep it
Describe the security measures for each asset
Flag any special category or criminal offense data clearly
Compare your register with the ICO or your national regulator's template
Set a yearly review date and update the register when things change

Frequently asked questions

Is an information asset register the same as a record of processing activities?

They overlap a lot. A record of processing activities focuses on how and why you use personal data, as Article 30 requires. An information asset register lists the information you hold and can include non-personal data too. Many small firms keep one spreadsheet that does both jobs.

Do sole traders need one?

If you process personal data regularly, such as client records or invoices with contact details, keeping records is sensible and may be required. The exemption for small organizations only covers occasional, low-risk processing without special category or criminal offense data. Check your regulator's guidance for your situation.

How detailed does the register need to be?

Detailed enough that someone else in your business could understand what data you hold, where it is and why. One row per data set with the core columns is usually enough for a small firm.

Does this apply to businesses outside the UK and EU?

GDPR can apply to businesses outside the UK and EU in some cases, for example if they offer goods or services to people there. Other countries and US states have their own privacy laws. A data inventory is good practice wherever you are, but check the rules that apply to you.

The bottom line

An information asset register is a plain list of the information your business holds, with an owner, a location, a purpose, a lawful basis, sharing details, a retention period and security notes for each item. For most small firms that handle customer or staff data regularly, it is also the simplest way to meet GDPR record-keeping duties.

Open a spreadsheet, list your systems and fill in the first few rows this week. Once it exists, a yearly review keeps it accurate, and you will always know where your data lives and why.