Paste your CRM field list. Get back what each field is, and what you can feed to AI.
Every field classified or flagged: personal data or not, the lawful basis it needs, how long to keep it, and whether it can go into an analysis model as it stands. Plus a draft record of processing per object. No account for the first run; nothing you paste leaves your browser until you choose to save it.
| Field | What it is | AI use |
|---|---|---|
| Health Notes | Health or medical information. Special category. | never |
| Lead Score | A score about a person. Profiling: needs a basis and a notice. | needs a basis |
| Email Opt Out | Opt-out flag. Keep for ever, never delete. | usable |
| Description | Free text. Contents unknown until reviewed. | never |
| Passport Number | Government identifier. Should not be here. | never |
| Industry | Firmographic. Not personal data. | usable |
Paste the fields, not the data
The list from your CRM's fields screen is enough: object, field name, type. Names are matched against a dictionary of what CRM fields actually hold, and a field nobody can name is flagged rather than guessed. If you paste a records export instead, fill rates are read and the values themselves can overrule the name (a "notes" column full of email addresses is contact data).
See what each field owes
Personal data or not. Special category or confidential. The lawful basis a controller usually relies on for it. A retention rule you can actually run. And the verdict the CRM project needs this quarter: usable for AI analysis as it stands, needs a basis and a notice first, or never.
File the record
Per object, a draft record of processing (GDPR Art. 30, CPRA recordkeeping) built from the fields you hold, the gaps that need closing before the AI project starts, and the controls the register is evidence for, with the artefacts an auditor accepts for each.
Why a register and not a data-discovery platform
The funded tools want to scan every system you own before they show you anything. Your CRM's field list already exists, and the person who administers it can paste it in a minute. What that list lacks is the column that says what each field is under privacy law and whether it can go anywhere near a model. That is the column this builds, from the names you already have, with no scanner, no connector and no account.
Field Register: the questions buyers ask
What is Field Register?
Field Register takes your CRM field list and classifies every field or flags it: personal data or not, the lawful basis it needs, how long to keep it, and whether it can go into an analysis model as it stands. It is for the person who administers the CRM and the one who has to sign the processing record.
What do I paste into Field Register?
`Object, Field, Type` per line, or just the field names. A records export with a header row and rows works too and is read for fill rates.
Does my CRM data leave my browser?
No. Classification runs in your browser and nothing you paste leaves it until you choose to save. No account is needed for the first run.
What will it tell me about each field?
Whether it is personal data or not, whether it is special category or confidential, the lawful basis a controller usually relies on for it, and a retention rule you can actually run. It also gives the verdict the CRM project needs: usable for AI analysis as it stands, needs a basis and a notice first, or never.
How does it handle a field nobody can name?
A field nobody can name is flagged rather than guessed. Names are matched against a dictionary of what CRM fields actually hold.
What if the values in a column do not match its name?
If you paste a records export, the values can overrule the name, so a 'notes' column full of email addresses is read as contact data and the fill rates are read alongside.
What do I get per object?
Per object you get a draft record of processing built from the fields you hold, under GDPR Art. 30 and CPRA recordkeeping. It also lists the gaps that need closing before the AI project starts.
Which regimes does it read against?
The GDPR, CCPA/CPRA and ISO/IEC 27701:2019. Every obligation is stated in our words and cited to its clause, and where the page names an obligation without stating its requirements, it says so and does not state them.
Is it a data-discovery platform?
No. The funded tools want to scan every system you own before they show you anything, while Field Register works from the field list your CRM already has. There is no scanner, no connector and no account.
Can I sign the record of processing straight away?
You get a draft record of processing per object built from the fields you hold, with the gaps that need closing flagged. It gives the artefacts an auditor accepts for each control, so the record is ready to review and sign.
How does it treat a health note or a lead score?
In the sample register a Health Notes field is marked health or medical information, special category and never usable for AI. A Lead Score is marked as a score about a person, which is profiling that needs a basis and a notice.
Where does the field dictionary come from?
The dictionary of field types is ours and is published in full at /fields/, with what each one owes. Nothing is generated on the fly.
How Field Register compares with a spreadsheet, a privacy lawyer or a general assistant
A spreadsheet, or the field list from your CRM's setup screen, holds the object, the field name and the type, and it is free, but it does not say what each field is under privacy law or whether it can go into a model. A data-discovery platform scans the systems you own before it shows you anything, and a privacy lawyer or a DPO can give a considered view and signs the record of processing; this register gives a draft record for review and never rules on you. A general AI assistant will explain special category data in plain language, but it will not classify your own pasted field names, let the values in a column overrule its name, or build a draft record of processing per object. Field Register classifies each field as personal data or not, special category or confidential, the lawful basis a controller usually relies on, a retention rule you can run and whether the field can feed an AI tool as it stands, against the GDPR, CCPA/CPRA and ISO/IEC 27701, and gives the artefacts an auditor accepts for each control.
Primary source: GDPR (Regulation (EU) 2016/679)