Where it stands

Who keeps this record

Set once: the name and contact details of the controller or processor, and of any representative and data protection officer.

Kept as

Organisation

Address

Telephone

Representative, where one is needed

Representative's contact details

Data protection officer, where one is appointed

DPO's contact details

One entry per activity. Leave a field empty rather than guess: the completeness check names it.

Activity

Owner

Purpose of the processing

Lawful basis

Categories of data subjects

Categories of personal data

Includes special category data Includes criminal offence data

Categories of recipients

Transferred outside the UK and EEA

Retention period, by the name it has in RETENTION if it is there

Source of the data

Data protection impact assessment

Touched by an incident

Last reviewed

Reviewed next

Technical and organisational security measures

Anything worth knowing

Basis

Special category

Transfer

Every field Article 30 asks for that is still empty, then the ones the ICO recommends alongside it.