Should the SDD entries include details of UPSI shared? 

The Structured Digital Database is not meant to be a database of UPSI itself but only to capture the nature of UPSI and details of sharing of such UPSI. In fact, maintaining the actual details of the UPSI instead of just the nature of UPSI may be considered as heightening the associated risk.