Information asset register: what goes in it and who owns it

What an information asset register is, and whether the law requires one

An information asset is “a body of information, defined and managed as a single unit so it can be understood, shared, protected and exploited efficiently”, in the glossary of the Code of Practice on the management of records issued under section 46 of the Freedom of Information Act 2000 (2021), which adds that “Information assets have recognisable and manageable value, risk, content and lifecycles.” The pupil records in a school's management information system are one asset; so are the box of paper SEN files, a care home's care planning system, a charity's supporter database and the payroll records. An information asset register lists those assets and records, for each one, where it is held, who owns it, who can reach it and how it is protected.

No UK statute requires a register called an information asset register. What the law requires is a record of processing activities: Article 30 of the UK GDPR says “Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility”, and the exception for an organisation “employing fewer than 250 persons” falls away where the processing “is not occasional” or includes special category data, which in practice covers most schools, charities and care providers. The record of processing activities guide covers what that record must contain. Article 30(4) requires the record to be made available “to the Commission on request”: since 30 September 2026 the regulator has been the Information Commission, still known as the ICO.

The ICO's own word for the groundwork is data mapping, not an information asset register. Its accountability framework toolkit Records of processing and lawful basis sets the control measure “Comprehensive data mapping exercises are carried out, providing a clear understanding of what information is held and where”, and tells organisations to “Carry out information audits (or data mapping exercises) to find out what personal information is held and to understand how the information flows through your organisation.” An information asset register is one practical way of writing that map down. The toolkit, as read on 2 November 2026, carries the banner “Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change.”

Three groups of organisations meet the register by name or in substance:

• Care providers completing the Data Security and Protection Toolkit. The toolkit's organisation types page describes social care as “An organisation that provides adult social care, such as domiciliary care, care homes and residential homes and day services” and says its toolkit view “is based on the Category 3 evidence items.” Evidence item 1.1.2 in the DSPT 2026-27 assertions and evidence items (version 9) asks: “Does your organisation maintain an up to date information asset register (IAR) and a record of processing activities (ROPA) and review this regularly?” The toolkit is an assurance standard, not law, and its help text for that item opens with a line that overstates the law (“To be compliant with data protection legislation you must keep a register of all of the information your organisation stores, shares and receives”): the legal duty is the Article 30 record, with its exception.
• Maintained schools and academy trusts in England, and other public authorities in England, Wales and Northern Ireland. Schedule 1 to the Freedom of Information Act 2000 makes the governing bodies of maintained schools, and academy proprietors for their academy work, public authorities, and the section 46 Code names “a school” among the bodies it covers (1.4.2). It says “Authorities should know what information they hold, why they hold it, how sensitive it is, and how it should be managed” (1.2.3) and “Authorities must periodically assess the information they hold” (2.1.3). That “must” is the Code's, not a statute's: the Code sets out good practice under section 46, and an authority that falls short of it can receive a practice recommendation from the regulator under section 48. The Code dates from 2021 and still refers to the Information Commissioner. Scottish public authorities follow their own records management code under section 61 of the Freedom of Information (Scotland) Act 2002.
• Charities. No primary source requires a charity, as a charity, to keep an information asset register; its legal duty is the Article 30 record. A charity that completes the Data Security and Protection Toolkit chooses the organisation type “Other (including charities, some companies and NHS Business Partners)”, which the toolkit lists as Category 3, and the toolkit, item 1.1.2 included, then covers only “the health and care data they process, not the full data processing of the organisation”. For every other charity the register is good practice, and the cheapest way to answer the ICO's data mapping question.

An information asset register is not the fixed asset register in the accounts, which lists equipment and property by value. The laptop goes in the fixed asset register; the information on it goes in this one.

What goes in an information asset register: the columns

No law or regulator sets the columns. The Data Security and Protection Toolkit asks for a register “that details where and how the information is held and how you keep it safe”; the government's guidance on the information asset owner role expects each owner to be “Ensuring an accurate and up-to-date information asset register is maintained” and “Ensuring that the information assets in the IAO's area reflect the retention schedule and that information is being kept and deleted in accordance with legal, regulatory and policy requirements”. A register that answers those questions for a school, a charity or a care provider usually has these columns:

1. Asset name and description – one body of information managed as a unit, such as “pupil records in the MIS” or “paper medication administration records, current residents”.
2. Format and location – the system and supplier, the paper file and the room, or the device, and whether the data sits in the UK.
3. Owner – a named senior person accountable for the asset, and the person who looks after it day to day if that is someone else.
4. Users and access – which roles can see or change it, and how access is granted and removed.
5. Personal data – whether it holds personal data, whether any of it is special category data (health, for example), and the row in the record of processing activities that describes the processing.
6. Source and sharing – where the information comes from and who it goes to: the local authority, the GP surgery, a payroll bureau, a funder.
7. Security measures – passwords and two-step sign-in, encryption, locked storage, backups.
8. Retention and disposal – the period from the retention schedule and how the information is destroyed at the end of it.
9. Business critical – whether the service could run for a day without it, and what the fallback is.
10. Risks – the known weaknesses and what is being done about them.
11. Last reviewed – the date and who reviewed it.

Finding the assets is the work. The Department for Education's Data protection in schools: data protection policies and procedures starts with “Step 1: identify your personal data assets” and lists where a school's personal data could be stored: management information systems, communication systems, safeguarding technology, health and social care records systems, curriculum management software, virtual learning environments, workforce systems, catering systems, equipment records, photo and video storage systems, paper records and photos, and statutory returns to the DfE and local authorities. A care provider's list runs from the care planning system and the paper records in each unit to the rota, payroll and training records; the toolkit's own examples of personal data shared with others are “needs assessments, prescriptions, payslips, care plans”. A charity's starts with its supporter database, its volunteer and safeguarding records, its case files and its grant reporting.

For a template, the toolkit's help text for 1.1.2 says “Example templates for the ROPA and IAR are available from Digital Care Hub”. Any spreadsheet with the columns above will do; the format matters less than every asset having a row and every row having an owner.

The information asset register and the ROPA: one register or two

The two registers look at the same information from different sides. The record of processing activities describes what the organisation does with personal data: the purpose, the people, the recipients, the retention and the security. The information asset register describes where the information lives and who answers for it. One asset (the MIS) supports many processing activities (admissions, attendance, safeguarding, statutory returns), and one activity can use several assets.

Both can sit in one document. For care providers, the toolkit's help text for 1.1.2 says: “You should have an Information Asset Register (IAR) that details where and how the information is held and how you keep it safe. You should also have a list of the types of personal data that are shared with others, for example needs assessments, prescriptions, payslips, care plans. This list is called a Record of Processing Activities (ROPA) and should detail how the data is shared and how your organisation keeps it safe. You can combine these into one register, but it is fine to have two separate documents.” For schools, the DfE builds the record of processing activities from the asset list: “Step 1: identify your personal data assets”, then “Step 2: list your personal data assets”, adding that “There's no definitive format you need to follow in creating your record of processing activities, so develop your own to suit your school's needs”.

Keeping two documents makes sense where the information asset register is wider than personal data. Under the section 46 Code a public authority should know what information it holds, not only its personal data, so a school's or trust's register can also list the finance system, governance papers, policies and contracts, none of which belongs in an Article 30 record. Whichever you choose, link them: each processing row should name the assets that hold the data, and each asset row the processing it supports, so that a change to one shows up in the other.

Care providers have a third list. Evidence item 7.1.1 of the toolkit asks “Do you have a digital asset register detailing your organisation's hardware and software, which is kept up to date?”, explains that it “is a list of the digital devices (hardware) and computer software your organisation uses”, and adds: “You can have a separate list of digital assets or combine it into one document with your Information Asset Register (see 1.1.2.)” The devices list is where the lost tablet is identified; the information asset register is where you find out what was on it.

Information asset owners, and how often to review the register

Every asset needs a named owner. The idea comes from central government: the guidance now titled The role of information asset owners in government says “An IAO should be a senior individual with overall accountability for the security, content, quality and distribution of an information asset” and “they can delegate operational responsibilities but not accountability.” It also says “IAOs are usually senior civil servants”: the formal role is a civil service one, and no school, charity or care provider is required to copy it. The principle scales down well. The business manager owns the MIS, the designated safeguarding lead owns the safeguarding system, the registered manager owns the care records and the head of fundraising owns the supporter database; each can hand the routine work to someone else, but the name in the owner column is the person who answers for the asset.

Each sector already has someone above the owners:

• Care providers: toolkit item 1.1.5 says “there must be a named person within your organisation who takes overall senior responsibility for data security and protection issues”. That person approves the register; the information governance policy guide covers the rest of the roles.
• Schools: the DfE's role of data protection officers lists among the DPO's tasks “making sure all assets containing personal data are appropriately managed and secure”. The DPO checks the register and advises; the owners remain the school's own staff. See data protection officer for schools.
• Charities: the trustees are responsible, usually through a named lead or committee. The ICO's toolkit asks organisations to “Keep the data map up to date and clearly assign the responsibilities for maintaining and amending it”, and offers as an option to “Assign a named staff member in each area or department to complete information audits and update details.”

On review, only the toolkit sets a period. For Category 3, the help text for 1.1.2 says “The register should have been reviewed and approved by the management team at least once in the last twelve months.” Only the IT suppliers' category (Category 2) words the item differently; the categories a care provider works from carry the same text. For schools and charities no period is set: the section 46 Code asks public authorities to “periodically assess the information they hold”, and a yearly review, approved by the leadership team or the board, is a sensible default rather than a rule.

The calendar is the weaker trigger. Update the register when something changes: a new system or supplier, a contract ending, a new way of sharing information, a breach, an owner leaving. An asset whose owner has left is the one most likely to be forgotten, so the leaver checklist should ask whether the person owned anything in the register.

Putting the register to work

A register that is filled in once and filed is a compliance exercise. It earns its keep when something happens and someone needs to know where the information is. The ICO's toolkit puts the risk of not knowing plainly: “Without management understanding of what personal information is processed, by who, where and who it is shared with, there is a risk of a data breach happening that is uncontrolled or unseen.”

• A breach. When a laptop, a phone or a bag of files goes missing, the register says what was on it, how sensitive it was, whether it was encrypted and who owns it, which is what the breach assessment needs in its first hour. Record the outcome in the data breach log.
• A subject access request or an FOI request. The register is the list of places to search. A search that misses an asset because nobody listed it is an easy way for a response to go wrong; see the subject access request policy and, for schools, freedom of information in schools.
• Retention and disposal. The retention column turns the schedule into actions per asset. For public authorities, the section 46 Code adds that they “must know why they are keeping it and must also be able to explain why they no longer hold information, by keeping a record of decisions to keep, archive or destroy information” (2.1.3); the data retention policy guide covers the schedule.
• A new system or supplier. Adding a row is the moment to ask whether a data protection impact assessment is needed (DPIA for schools) and whether the supplier has a data processing agreement.
• Business continuity. The business-critical column is the start of the continuity plan; in the toolkit, the next item after the digital asset register, 7.1.2, is the business continuity plan.

The ICO's toolkit ends its data mapping section with three questions worth asking of any register, including “Would the record match what people were currently doing?”

Where ComplyChat fits, and where it does not

That last question is the hard one, because a register is built by asking owners what they hold, and the information nobody owns never comes up. A care team passes on a resident's change in condition in a group chat so the night shift knows; a teaching assistant tells colleagues why a pupil went home; a charity coordinator posts the week's home visits to the volunteers. Each is a body of information used and shared for the organisation's work. None has an owner who can be named, a location the organisation manages or a retention period, and each leaves with its members when they leave. If one of those phones is lost, the register cannot say what was on it.

Start with what ComplyChat is not. It is not an information asset register, data mapping software or a records management system, and it does not do care planning or hold pupil records. It does not capture, archive or connect to WhatsApp. It is not end-to-end encrypted, by design, because the organisation has to be able to hold the record. If your staff all have work accounts and nothing they say has to be kept, the chat in the office software you already pay for may serve you better. ComplyChat is working towards Cyber Essentials and ISO 27001 certification and holds neither yet.

What it does is give work conversations a place the organisation runs, so they can have a row in the register like any other system. Staff, and the volunteers, families or parents who need to be in the conversation, are added by their mobile number, and a number verified by SMS is the identity, so nobody needs an account on your systems. Everyone added to a channel is told it is on the record and can object or leave. Messages are recorded on the server as they are sent, not gathered from handsets afterwards, and on paid plans, once your organisation's tenant is connected, they are kept under the retention schedules within your own Microsoft 365 subscription. That gives the row an owner, a location and a retention period. Free is for personal conversations – one private group, direct messages, up to 25 people and three calendar months of recent history, with no Microsoft 365 archive – so it cannot meet a retention duty.

Whatever you use, take one question to the next leadership or board meeting: of the places your staff shared information about pupils, residents or service users this week, which could you name an owner for?

Questions people ask

What is an information asset register?

An information asset register is a list of an organisation's information assets that records where and how each is held and how it is kept safe – the wording the NHS Data Security and Protection Toolkit uses for care providers. In UK government practice each asset also has a named owner who is accountable for it and makes sure it follows the retention schedule.

Is an information asset register a legal requirement?

No UK statute requires a register called an information asset register. The UK GDPR requires a record of processing activities (Article 30), with a limited exception for organisations employing fewer than 250 people that does not apply where processing is not occasional or includes special category data. Care providers completing the Data Security and Protection Toolkit are asked to keep an information asset register and a record of processing activities, which may be one combined register, and the section 46 Code tells public authorities, including schools, that they should know what information they hold.

What is an information asset?

An information asset is “a body of information, defined and managed as a single unit so it can be understood, shared, protected and exploited efficiently”, with “recognisable and manageable value, risk, content and lifecycles”, in the definition in the Code of Practice on the management of records under section 46 of the Freedom of Information Act 2000. A school's pupil records in its MIS, a care home's care plans and a charity's supporter database are each an information asset.

What are some examples of information assets?

For a school, the DfE lists places personal data assets sit: management information systems, communication systems, safeguarding technology, health and social care records systems, curriculum software, virtual learning environments, workforce and catering systems, photo storage, paper records and statutory returns. For a care provider, the Data Security and Protection Toolkit gives needs assessments, prescriptions, payslips and care plans as examples of personal data held and shared.

Who is an information asset owner?

In UK government guidance, an information asset owner is “a senior individual with overall accountability for the security, content, quality and distribution of an information asset”, who can delegate operational tasks but not accountability. Schools, charities and care providers are not bound by that civil service role, but naming a senior owner for each asset is the same idea; the Data Security and Protection Toolkit (item 1.1.5) asks a care provider for a named person who takes overall senior responsibility for data security and protection.

What is an asset register and what information does it contain?

“Asset register” usually means the fixed asset register in the accounts, which lists equipment and property with their cost and value. An information asset register is different: it lists bodies of information, with their location, owner, access, security and retention. Care providers using the Data Security and Protection Toolkit also keep a digital asset register of hardware and software (item 7.1.1), which may be combined with the information asset register.

Official guidance and your next step

The legal duty is in Article 30 of the UK GDPR. The ICO's expectations are in its accountability framework toolkit Records of processing and lawful basis, marked as under review after the Data (Use and Access) Act. Care providers work from the DSPT 2026-27 assertions and evidence items (version 9, Category 3, items 1.1.2, 1.1.5 and 7.1.1). Schools in England have the DfE's data protection policies and procedures and role of data protection officers, and public authorities in England, Wales and Northern Ireland the Code of Practice on the management of records (2021). The government's guidance on the information asset owner role describes the civil service model. The toolkit quotations are from its 2026-27 (version 9) spreadsheet published on 2 October 2026 and its organisation types page, both read on 3 November 2026; the ICO toolkit was read on 2 November 2026; the reply quoted in section 06 is from WhatDoTheyKnow, as captured, classified and verified for our evidence pack on 29 October 2026, and is that trust's reply on its date, not a statement of its current practice.

This guide covers the UK, with the DfE's guidance for schools in England, the toolkit for organisations in England that complete it and the section 46 Code for public authorities outside Scotland, and is not legal advice. The Article 30 record itself is covered in record of processing activities.

Then do one thing: write one row today for the asset your organisation could least do without – where it is, who owns it, who can reach it, how it is protected and when it was last reviewed. If any of those cells stays empty, that is the first item for the register.