Creating and editing information assets

Each information asset record captures technical and governance details about a system or location that processes personal data.

How to create an asset

1. 1 Go to Dashboard → Assets.
2. 2 Click the + New Asset button (bottom right).
3. 3 Enter the Asset Name (e.g. "SystmOne - GP Clinical System").
4. 4 Select the Asset Type: Database, Server, Application, Cloud Service, Physical Media, or Other.
5. 5 Set the Security Classification: Official, Official-Sensitive, or Secret.
6. 6 Check the boxes that apply: Contains PID (Personal Identifiable Data), Contains Special Category Data, International Transfer.
7. 7 Set Encryption at Rest and Encryption in Transit — Yes, No, or Partial.
8. 8 Assign an Asset Owner (must exist in Dashboard → Asset Owners).
9. 9 Set the Retention Period and Statutory Basis.
10. 10 Link to one or more ROPA entries.
11. 11 Click Save.

Key fields explained

• Contains PID — tick this if the asset stores names, NHS numbers, dates of birth, addresses, or other directly identifying information.
• Contains Special Category Data — tick this if the asset stores health data, biometrics, ethnicity, religion, political views, or trade union membership.
• International Transfer — tick this if the system is hosted or accessed from outside the UK.
• Encryption at Rest — is stored data encrypted (e.g. AES-256 disk encryption)?
• Encryption in Transit — is data encrypted when moving over a network (e.g. TLS 1.2+)?