A data asset register template that records systems, years held and rights

What is a data asset register, and what goes in it?

A data asset register is a metadata-only table that lists the record collections a company holds, where each lives, who owns it, how many years it covers and what limits its use. It never contains the records themselves. For a mid-sized company, one page per system is usually enough to give a board or CFO a view of records as assets.

The same sheet doubles as a first fit screen for a SourceX introduction. A company with 50+ full-time employees at peak (contractors excluded), several years of documented operations and many systems will show it in the register without a single record leaving the building.

The register template

Copy the columns below into a spreadsheet. One row per system or record collection. Keep entries short and factual.

Paste-ready row lines

Use these lines as starting entries, then replace the placeholders. Each line is one row written in plain text.

How do you fill it in without exposing records?

Fill it from system settings, vendor admin pages and interviews with owners. If you need to open a record to answer a column, the column is too detailed.

1. Start with a list of every system that touches money, customers, staff or product, including archived ones.
2. Assign one named owner per row. If nobody owns a system, mark it and escalate.
3. Record the earliest and latest year from the system's own date range filters or the owner's knowledge.
4. Capture the retention setting exactly as configured, and flag any auto-deletion.
5. Note rights and sensitivity in categories only: contracts reviewed or not, privacy promises reviewed or not, personal data present or not.
6. Have the controller or CFO review the register once per quarter, in the same meeting as the budget assumptions log.

What does the register tell you about licensing fit?

Read the finished register against five questions.

If most rows look strong, run the company fit checker with the owner's permission. It is a preliminary, non-binding screen with no contact details required.

What rights notes should say

Say what has been checked, not what you assume. A company that promised customers in its privacy policy or terms that their information would not be used for other purposes has to honor that promise. The FTC has published staff guidance on companies quietly changing their terms to allow AI training, and that guidance is a reason to record what the privacy policy and customer terms say before any license is considered. It is staff guidance, not a rule, and the company and its counsel decide how it applies. This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

What never to put in the register

• Customer lists, employee names or any personal data.
• Pasted contract text, pricing or confidential terms.
• Samples, screenshots or exports of records.
• Promises of payment or typed reward figures.

When to use the register in client work

For teams that already document Zendesk, there is a related metadata-only Zendesk inventory for introductions.

Next step

Fractional CFOs who maintain registers for several clients are well placed to spot which ones merit an introduction. Read the fractional CFO partner overview and the guide to CAS growth at large firms, and use the ERP cleansing checklist before any migration deletes history. Check the baseline on who qualifies, then register as a partner.

The partner earns 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, up to $100,000 cumulative per referred company, and it becomes payable only after the buyer pays and SourceX receives its fee. Rewards are not guaranteed, and the reward is never deducted from what the company receives.