> For the complete documentation index, see [llms.txt](https://intuitem.gitbook.io/ciso-assistant/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intuitem.gitbook.io/ciso-assistant/concepts/specialised-modules/privacy-register.md).

# Privacy register

A **privacy register** is the catalogue of personal-data processing activities the organisation carries out — required by GDPR and equivalent regulations as the foundation of accountable data handling.

CISO Assistant models the register as a graph of typed objects so it stays queryable, auditable, and reusable across audits.

## Mental model

* **Processing** — an activity that operates on personal data (collect, store, transfer, delete). The central object.
* **Purpose** — the lawful reason a processing exists. Each processing has at least one purpose.
* **Personal data** — what is being processed (name, email, location, health record, biometric, …), with categories that map to GDPR sensitivity classes.
* **Data subject** — the kind of individual the data refers to (employee, customer, prospect, …).
* **Data recipient** — the internal teams or external parties that receive the data.
* **Data contractor** — third parties that process data on your behalf — a TPRM entity surfaced here with a privacy-specific lens.
* **Data transfer** — flows of data to entities outside the original jurisdiction.

{% hint style="info" %}
Personal data entries can be created in batch from a processing's detail page: the **Batch create personal data** button (layer-group icon on the **Personal Data** table) opens a picker of categories grouped by theme — drawn from the [terminology](/ciso-assistant/concepts/specialised-modules/terminology.md) layer — and applies the same **Retention**, **Deletion Policy**, and **Is sensitive** values to every entry it creates. Categories the processing already records are skipped.
{% endhint %}

## Event objects

Privacy operations also need to record events as they happen:

* **Right requests** — data-subject requests under GDPR (access, rectification, erasure, portability) and the organisation's response.
* **Data breaches** — incidents affecting personal data, with the notification clock and authority correspondence.

## How it ties into the rest of the platform

* A privacy register lives in a **domain** with its own RBAC scoping — typically a DPO-led folder.
* Findings from GDPR audits surface in the register as actions on processings.
* Data contractors cross-reference TPRM entities, so a sub-processor's security review feeds both worlds.
* A processing's **nature** and its personal-data **categories** draw from the [terminology](/ciso-assistant/concepts/specialised-modules/terminology.md) layer, so you can align them to your own internal vocabulary.
* A processing can be exported as a multi-sheet Excel workbook from its detail page and re-imported — through the data import wizard or the CLI — to recreate it with all its sub-objects. See [Data import](/ciso-assistant/configuration/data-import.md#processings).

## Related

* [Domains](/ciso-assistant/concepts/foundations/domains.md)
* [Third-party risk](/ciso-assistant/concepts/specialised-modules/third-party-risk.md)
* [Terminology](/ciso-assistant/concepts/specialised-modules/terminology.md) — customise processing nature and personal-data category labels
* [Vocabulary → Processing / Personal data / Purpose / Right request / Data breach](/ciso-assistant/introduction/vocabulary.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://intuitem.gitbook.io/ciso-assistant/concepts/specialised-modules/privacy-register.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.