Free Key Register Template (UK): PDF & Excel

After an incident, the first question is who had access? A key register answers it in seconds, and its absence is what insurers’ loss adjusters notice. This template pairs a key inventory with an issue-and-return log, signatures both ways.

⬇ Download PDF (print-ready)⬇ Download Excel (editable)

Free for use within your organisation. No sign-up required.

How to use it

• Inventory every key and copy once; store spares in a controlled place and say where on the sheet.
• Every issue and every return gets a signature: no exceptions for managers.
• Audit at least annually; treat an unreturned key as an incident, not an oversight (and consider whether locks need changing).

Full guidance: key registers: requirements and best practice.

Who must keep this record

No single regulation names the key register, but if you hold keys to premises, vehicles, safes or restricted areas, you need one. Commercial insurance policies often carry conditions about key security, and weak key records can give an insurer grounds to reduce or refuse a claim after a break-in. In regulated environments, inspectors will ask who had access.

• Anyone issuing keys to staff, cleaners, contractors or out-of-hours callers
• Sites with master keys, where one loss can force a change of every affected lock
• Anyone who may have to prove key control to an insurer, auditor or investigator
• Anyone running electronic credentials alongside keys (see access control records)

How long to keep it

Keep key register records for at least five years. After a security incident, older records can still matter, particularly where an insurance claim or a dispute turns on who held a key on a specific date, so archive rather than destroy the moment five years is up. The register itself stays live for as long as the locks are in use.

What a completed entry looks like

One line per key, filled in properly, reads like this.

• Key reference: K-014, unique to that key, with the total cut for the lock (4) recorded so all four can be accounted for
• Lock or area: rear fire exit, Unit 3 stores
• Issued to: A. Hollis, warehouse supervisor, issued 04/03/2026, signed on collection
• Returned: 12/08/2026, signed by the holder and by whoever took it back
• Master keys: listed separately by unique reference, with every person who has ever held one and any loss or suspected compromise

FAQs

Do we need a key register if we only have a handful of keys?

Our guidance sets no size threshold. The point is being able to say who held which key on a given date, and insurance conditions about key security apply whatever your headcount. For a small site a single sheet is enough.

What if someone leaves without returning a key?

Record it as an incident rather than an oversight. The register should show the return of all keys on or before an employee's last working day, so where a key is lost or not surrendered, log that fact and carry out a risk assessment on whether the affected locks should be changed. Keeping the record is the evidence you acted.

How do we know every key is accounted for?

Record the total number of keys cut for each lock, then check the register against the physical keys at least annually. Any key that cannot be accounted for should trigger a security review and potentially a lock change.

Do master keys need anything extra?

Yes. Give each master key a unique reference, record everyone who has ever held it, and log any loss or suspected compromise. Losing one may mean changing every lock it opens, so keep holders to the minimum, and in high-security settings have a designated key custodian keep a separate master key log.

Sources

ICOUK GDPR: security guidance (premises access)

Tell me when the rules behind this template change (free, one email when it happens, nothing else).