# Data Asset Register

**Purpose.** The catalogue of what data you hold, who owns it, how sensitive it is, and where it lives. Almost every other governance control depends on it.

**When to use it.** Start it early and keep it current. Review entries at least annually, and whenever a system or a data flow changes.

**How to use it.** Register your ten most important assets properly rather than every asset badly. A short accurate register is used; an exhaustive stale one is not. Set a review date on every row so staleness becomes visible.

---

### Register fields

| Field | Why it matters |
|---|---|
| Asset ID | Stable reference for linking from other registers |
| Name & description | What it actually is, in business language |
| Domain | Links to the owner |
| Data Owner | Named accountable person |
| Steward | Day-to-day contact |
| Classification | Drives handling rules |
| Personal data? | Triggers DPIA and lawful basis questions |
| Special category? | Triggers additional protection |
| System of record | Where the authoritative copy lives |
| Source | Where it came from; licence if external |
| Lawful basis | Required for personal data |
| Used in AI? | Links to AI System Inventory |
| Quality thresholds | Links to Data Quality Standard |
| Retention | How long, and under what rule |
| Last reviewed / next review | Makes staleness visible |

### The register

| ID | Asset | Domain | Owner | Class. | Personal? | System | Used in AI | Retention | Next review |
|---|---|---|---|---|---|---|---|---|---|
| DA-001 | Customer master | Customer | [name] | Confidential | Yes | [CRM] | AI-003 | [7y] | [date] |
| DA-002 | Employee records | Employee | [name] | Confidential | Yes | [HRIS] | AI-007 | [6y post-exit] | [date] |
| DA-003 | Product telemetry | Product | [name] | Internal | No | [warehouse] | AI-001 | [2y] | [date] |
| DA-004 | Support transcripts | Customer | [name] | Confidential | Yes | [helpdesk] | AI-002 | [3y] | [date] |

### Practical guidance

**Start where the risk is.** Personal data, regulated data, and anything
feeding an AI system first. Marketing collateral can wait.

**One row per asset, not per table.** "Customer master" is an asset;
forty database tables that compose it are not forty assets.

**The "used in AI" column earns its keep.** When a model misbehaves, this is
how you find what fed it. When a data subject exercises their rights, it is
how you find where they appear.

> **The staleness test**
> A register nobody has updated in six months is a liability, not a
> control — it gives false assurance. Better to register fewer assets and
> keep them true.

### Maintenance

| Trigger | Action |
|---|---|
| New system or data flow | Register before production use |
| Classification change | Update; review downstream handling |
| New AI use of the asset | Update the AI column; check lawful basis covers it |
| Annual review | Owner confirms accuracy or corrects |

---

## Adaptation notes

- **Small organisations:** A spreadsheet with the first eight columns is genuinely enough. Do not buy a catalogue tool before you have proven you will maintain a list.
- **Existing catalogue tooling:** Do not duplicate. Add the governance-specific fields — owner, classification, lawful basis, AI usage — to what you already have.
- **Regulated sectors:** Add lineage and critical-data-element flags, and link to your regulatory reporting inventory.

---

*From the [Open Data & AI Governance Kit](https://lsdeva.github.io/governance-kit/). Licensed [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — free to use, adapt, and share with attribution.*

***Not legal advice.** Adapt to your jurisdiction, sector, and risk appetite, and have qualified counsel review anything material.*