GDPR records are more than a simple spreadsheet
Records of processing activities help organisations understand how personal data flows through their operations. They must identify processing activities, controllers, purposes, legal bases, categories of data subjects, data used, recipients, retention periods, processors, transfers and security measures.
Usable records support decision-making: should a processing activity be corrected, a DPIA initiated, a retention period revised, a processor documented, access restricted or a response to a data subject request prepared? If the records do not support these decisions, they become an administrative file that is difficult to maintain.
Information to document
Each entry in the records must address a specific purpose. The purpose explains why the processing activity exists; it must not be replaced by the name of a software application. The legal basis must be determined according to the context: legal obligation, contract, legitimate interest, task carried out in the public interest, consent or another applicable basis.
The categories of data subjects and data must be sufficiently clear to assess risk: employees, applicants, customers, service users, suppliers, identification data, HR data, financial data, health data, connection data or sensitive data, where applicable. Recipients and processors must be named or described in a verifiable way.
Retention periods, security, transfers and responsibilities
A retention period must be linked to an operational or legal rule. When it is unknown, the records must flag the gap rather than conceal the absence of a decision. Transfers of data to third countries outside the EU/EEA, where applicable, must be identified and documented according to the relevant legal mechanism.
Security measures must be described in practical terms: access rights, logging, encryption where applicable, segregation, backups, deletion and periodic reviews. The records must also identify the business owner of the processing activity and the person responsible for updates.
Build the records in five steps
The first step is to define the scope: entities, departments, applications, priority processing activities and key contacts. The second is to identify existing processing activities with business teams and the IT department. The third is to assess risks and gaps: sensitive data, absence of a legal basis, uncontrolled retention, incomplete processor documentation or overly broad access rights.
The fourth step formalises corrective actions and decisions. The final step is to organise updates to the records whenever significant changes are made to processing activities and according to a review frequency suited to the organisation.
Use the records to manage compliance
The records can be used to map processing activities, prepare for audits, respond to access or deletion requests, identify processing activities requiring a DPIA, monitor application changes and maintain evidence of compliance.
They must be connected to IT projects. A new tool, interface, data migration, outsourcing arrangement or change of purpose must trigger a review of the records. This connection between compliance and project delivery prevents gaps from being discovered only after go-live.
Do not confuse records of processing activities with a DPIA
The records list and describe processing activities. A DPIA provides an in-depth analysis of the risks posed by processing that is likely to result in a high risk to individuals. The records may trigger a DPIA, but they do not replace it.
The right approach is to use the records as a starting point: sensitive processing activities, large volumes, monitoring, special categories of data or automated decision-making must be identified to determine whether an impact assessment is required.
To make your records more reliable, address gaps and organise evidence of compliance, see our practical GDPR support. When the focus is on long-term compliance governance, the records can also support GDPR and DPO governance. To learn more about moving from records to risk analysis, see our GDPR DPIA methodology.
Do you need to improve existing records or consolidate fragmented GDPR compliance activities? Discuss your GDPR records with us.