The working toolkit
Choose a register for ongoing tracking or a guided document for a decision. Complete labelled fields, save a working copy and return when you are ready.
Blank working registers with filters and completion guidance. Prefer CSV? Download all ten registers ↓
Use this working document to organise a proportionate review of actual controls. Complete the evidence and sampling fields before assigning findings. A completed self-assessment is not independent assurance or an ICO certification.
Complete this assessment before introducing or materially changing processing that is likely to create a high risk. Apply the ICO screening criteria and their conditions. Record risks to people as well as delivery risks to the organisation.
Use one activity record for each coherent processing purpose and maintain separate controller and processor records where both roles apply. Reconcile the records with actual systems and supplier arrangements.
Complete the basis decision for each purpose before drafting notices. Use the LIA section for ordinary legitimate interests; recognised legitimate interest is a separate, restricted statutory basis.
Set a reasoned schedule by record class, with a clear trigger and disposal method. Distinguish legal minimum periods, regulatory guidance, limitation considerations and the organisation’s own justified policy.
Follow the actual legal entities and access arrangements, then identify the transfer route and evidence needed. Use the official IDTA or Addendum where appropriate; this worksheet is not a transfer contract.
Open this record as soon as an incident is identified. Log facts, timestamps, decisions and actions as they become known. Use a real incident response lead; a worksheet cannot monitor or submit a notification for you.
Use this record from initial receipt to final response. A request can arrive verbally or through any normal contact channel. Keep a reasoned, proportionate search and disclosure record.
Make three separate decisions: DPO requirement, territorial representative requirement and annual data protection fee. A fee registration is not a compliance certificate.
Combine a permissions review with observed browser and campaign behaviour. Use a controlled test environment or an authorised inspection of the relevant website. Record findings rather than assuming a banner’s appearance proves compliance.
A transfer worksheet helps prepare the decisions and required details. The binding agreement must be completed and agreed by the relevant parties. Read the transfer guide and follow the official links →