Data Collection Point (DCP)

The Data Collection Points screen is where your organisation documents every channel through which personal data arrives — a newsletter sign-up form, an HR onboarding questionnaire, a third-party data feed, a chatbot intake. Before data can be stored, processed, or shared, it must first be collected somewhere, and this screen is where those "somewhere" points are catalogued, classified, and linked to the rest of your compliance work. A DPO relies on this register to answer "where exactly did you collect this person's data?" during a Subject Access Request. A compliance officer uses it to demonstrate that every collection point has a documented legal basis. An auditor checks it to verify that data flows are complete and up to date.

Within the broader DPMS picture, DCPs sit upstream of your Record of Processing Activities (RoPA) and your Asset Register. Keeping them accurate and in an Active status means every downstream relationship — assessments, linked documents, tasks, workflow approvals — has a solid anchor.

How to open it

Navigate to the Data section in the left-hand sidebar and click Data Collection Points. No sub-menu expansion is needed; it is a direct top-level entry.

Heads up: You need at least the read permission for Data Collection Points to see this screen at all. If you can only see records where you are the assigned responsible person, your account has the "read own/assigned" permission rather than full read access — speak to your IT administrator if you need broader visibility. The Create button is only available to users with the create permission, and the Import option additionally requires the import permission.

What you see

The index page opens with five status filter tabs running across the top: All, Active, Draft, Inactive, and Review. These match the standard DPMS lifecycle states and let you instantly narrow the table to just the records you need to act on today. To the right of the tabs is the search and filter bar; in the top-right corner sits the Create button.

Below that is the main table. Each row is one DCP, showing its Name and Type (the classification tags you assign, such as "Web Form" or "API Intake"). Clicking any row opens that DCP's full detail view. At the top-right of the table you will also find export buttons for downloading the current filtered list as a JSON or XLSX file — useful when an auditor asks for an offline copy.

When you open an individual DCP, you land in the detail view: a two-column layout with a collapsible left-hand side menu for navigating between tabs (General, Documents, Tasks, Assessments, Workflows) and a wide main panel on the right. At the very top of that main panel is the sticky header actions panel, which shows the responsible person(s), status dropdown, and last-updated timestamp — controls that save immediately without requiring you to open the edit form.

Working with this screen

Creating a new Data Collection Point

When a new data-collection channel goes live in your organisation — a freshly launched contact form, a new HR data feed, a cookie consent banner — you should register it here before it goes into production, or as soon as possible afterwards.

Click the Create button in the top-right corner and select Create Data Collection Point from the dropdown. You arrive at the creation form, which opens on the General tab.

Start at the top of the form. Use the Responsible Person picker to assign the colleague or team accountable for keeping this record up to date — every DCP should have a named owner. Leave the Status as Draft for now; you can promote it to Active once you have finished filling everything in and a reviewer has approved it.

Select the relevant Organisational Unit (for example, "Marketing" or "HR"). This classification enables filtered reporting and helps business-unit leads own their collection points.

In the Type field, choose one or more tags that describe how data is collected — "Web Form", "Paper Form", "API", "Cookie Banner", and so on. If the tag you need does not exist yet, simply type it and select the option to create it; the new tag will be saved to the shared tag library for future use.

Enter a clear Name — this is the only required field. Something specific, like "Newsletter Sign-Up Form" or "Employee Onboarding Questionnaire", is far more useful than a generic label. Use the Short Description field to explain what data is collected and for what purpose; this context is invaluable for auditors and new team members.

When you are satisfied, click Save at the bottom of the form. DPMS creates the record and redirects you to the full detail view. The rest of the tabs — Documents, Tasks, Assessments, and Workflows — are now unlocked and ready to use.

Tip: Save the General tab first, even if you have not filled in every field. The other tabs only become accessible after the record has been saved at least once.

Reviewing and updating an existing DCP

Open the record from the index by clicking its row. The General tab shows all the core attributes in a read-only view. To make changes, click the Edit button within that view, which takes you to the edit form pre-populated with the current values.

For quick changes — reassigning the responsible person or moving the status — you do not need to open the edit form at all. Use the header actions panel at the top of the detail view: click the responsible person display to open the picker, or click the status dropdown to choose a new lifecycle state. Both changes save immediately the moment you make your selection.

To see a full audit trail of every change ever made to this record — who changed the status, when a responsible person was updated — click the clock icon in the top-right corner of the detail view. This opens the Activity Log drawer, a timestamped history of all edits.

Heads up: Status changes in the header actions panel are applied immediately — there is no confirmation step. If you click the wrong status by mistake, simply click again to correct it.

Linking documents, tasks, and assessments

Once a DCP is saved, you can enrich it by linking related records from other parts of DPMS. This is where the left-hand side menu becomes your guide.

Click Documents in the side menu to attach the relevant privacy notice, data-sharing agreement, or policy document. Use the Add button within the tab to search for and link existing documents from the Policies & Documents module. Linking a privacy notice here makes it easy to confirm, during an audit, that the correct notice was in place at the point of collection.

Click Tasks to create or link follow-up actions — for example, a task to review the DCP annually, or a task to update the description when the underlying form changes.

Click Assessments to associate a DPIA or other privacy impact assessment with this collection point.

Stepping through DCPs in bulk (Review workflows)

When you need to work through a batch of DCPs — for example, all records in Review status at the end of a quarterly cycle — you do not have to keep returning to the index list.

On the index, click the Review status filter tab to narrow the table to just those records. Open the first one. At the top of the detail view, just to the right of the breadcrumb, you will see left and right chevron arrows. Click the right arrow to move directly to the next DCP in your filtered list. Click the left arrow to go back. The filter context travels with you, so every record you step through belongs to the same filtered set.

If you receive a workflow notification asking you to approve or review a specific DCP, clicking the notification link will open that DCP's detail view and jump straight to the Workflows → Required Action sub-tab, where you can complete the review task without needing to navigate manually.

Importing DCPs in bulk

If you have a JSON export of DCP records — for instance, from another DPMS instance or a previous system — you can load them all at once. Click the Create dropdown and select Import. Your operating system's file picker opens; select your .json file. DPMS processes the file and, on success, reloads the index showing all imported records with Draft status. You can then use the search bar and filter tabs to find and review them.

Heads up: The Import option is only functional if your account has the import permission. If clicking it does nothing, contact your IT administrator — there is no error message shown when the permission is missing.

Field reference

How this connects to the rest of DPMS

DCPs are an upstream dependency for much of the rest of your compliance register. Once a DCP is in Active status, it can be referenced in your Record of Processing Activities (RoPA) to show exactly where the data for a processing activity originates. It can be linked to DPIAs and assessments to anchor risk analysis at the point of collection. And when you respond to a Data Subject Access Request, your DCP register is where you look first to trace the provenance of the data.

The Type tags shown in the creation form and on the index table are managed in Compliance Settings → Tags → Data Collection Point Types. If the Type field looks empty or lacks the tags your organisation uses, a system administrator needs to set those up there first. Similarly, any custom status values in the status dropdown come from Compliance Settings → Statuses. The Workflows sub-tab only shows content once at least one workflow template has been configured in the Workflows module — if the sub-menu is empty, that is where to look.

After finishing your DCP setup, consider:

• Linking the relevant privacy notice in the Documents tab.
• Triggering a review workflow if your organisation requires sign-off before a DCP goes Active.
• Cross-checking the RoPA to confirm that any processing activities drawing data from this collection point are correctly documented.

Tips & common pitfalls

Tip: Always save the General tab before trying to access any other tab. Documents, Tasks, Assessments, and Workflows are locked until the record exists in the system.

Heads up: Status changes from the header actions panel are immediate — there is no undo button or confirmation dialog. Double-check before clicking a new status, especially when moving a record from Draft directly to Active.

• Only your own records visible? If you can only see DCPs where you are listed as the responsible person, your account has restricted read access. Ask your IT administrator to review your permissions.
• Prev/next arrows missing? These arrows only appear when you opened the DCP by clicking through from the index list (or a filtered view). If you arrived via a direct bookmark or notification link, the arrows may not reflect a meaningful filter. Go to the index, apply your filter, then step through from there.
• Custom statuses in the dropdown you don't recognise? Your organisation may have added custom lifecycle statuses in Compliance Settings → Statuses. These appear alongside the four system defaults. Check with your compliance settings administrator if you are unsure what a custom status means.
• Import option does nothing when clicked? This happens silently when you lack the import permission. No error is shown. Contact your IT admin if you need bulk import access.
• Activity Log not visible on a shared record? The clock-icon changelog is intentionally hidden for DCPs received from an organisation's shared library or viewed in Consulted mode. This is by design.
• Type column showing the wrong language? The Type tags on the index table are resolved when the data loads. If you change your language setting mid-session, the Type column may still show the previous language until you refresh the page.