One of the main novelties of the GDPR is the obligation for controllers and processors to create and keep an updated record of the processing activities<\/strong> and their data, as set out in Art. 30 of the GDPR<\/strong>:<\/p>\n\n\n\n
For data controllers, this obligation is found in the first paragraph: “Each data controller<\/span> and, where applicable, the controller\u2019s representative shall maintain a record of processing activities under its responsibility”.<\/em><\/p>\n\n\n\n
For processors, we must go to the second paragraph: \u201cEach processor<\/span> and, where applicable, the processor\u2019s representative shall maintain a record of all categories of processing activities carried out on behalf of a controller\u201d.<\/em><\/p>\n\n\n\n
The article continues by indicating the minimum contents of the record of processing activities<\/strong>, also indicating that it can be created and maintained in electronic or manual format.<\/p>\n\n\n\n
Where the record is of the controller, the name of the controller on behalf of which the processor is acting must be added to the above.<\/p>\n\n\n\n
At a practical level, a good record of processing activities should be the basis for the remaining GDPR obligations, which include:<\/p>\n\n\n\n
For this, the record of processing activities must clearly define the purpose of each process<\/strong>, avoiding generic records such as “clients”, “workers” or “suppliers”. <\/p>\n\n\n\n
A good record of processing activities clearly identifies which type of processing is carried out in each category or type of data and then, and only then, the record is complete; Some of the usual records of processing activities are:<\/p>\n\n\n\n
As can be seen, despite the fact that the category of data subjects may be the same in these examples of records of processing activities (for example, labour control and personnel training that affect workers in both cases), aspects such as the following may differ in each case: lawful basis, data retention period, purpose, etc.<\/p>\n\n\n\n
This work is very often conducted by GDPR regulatory compliance programmes or tools, although the company or its advisor should, in any case, ensure that the criteria set by the company that owns the programme is adapted to the situation of the controller or the processor.<\/strong><\/p>\n\n\n\n
These tools are very useful but, as always, they must be adapted to the needs<\/strong> of the person who must comply with the GDPR and not the other way around. Having a good record of processing activities<\/strong> is the basis for proper compliance with the GDPR.<\/p>\n\n\n\n
If you need more information about this issue for your company, don’t hesitate to contact us!:<\/p>\n\n\n\n
<\/p>