Record a processing activity

Steps

A processing activity is the centre of the programme. Every other register hangs from it.

1. 01Create the recordOpen Processing activities, press the plus button, and choose Processing activity. The context you are in is inherited.
2. 02State the special categories firstAnswer whether special category data under Article 9 or criminal conviction data under Article 10 is processed. The conditions and safeguards asked for later follow from these answers.
3. 03State the purposeChoose the controlled purpose so activities can be aggregated, then write the specific purpose in the words a supervisory authority would read.
4. 04Complete the contextName the controller, the processors, the data subject sets, the categories of personal data and the recipients.
5. 05Name who is accountableGive the owner, the author and the approver, and link the Data Protection Officer where one is appointed.
6. 06State retention and securityGive the retention period and the measures relied upon, and record whether personal data leaves the Union.
7. 07Move the record to in useTake the steps through legal review and approved. From in use, the activity appears in the record of processing and its Article 30 duties apply.

The context page

The context page holds the parties, the data subject sets, the categories of data and the recipients. Fields that do not apply to your organisation can be left inactive rather than answered falsely.

The accountability page

Ownership is asked at every level: who owns the record, who wrote it, who approved it and who advises on it.

Reading the register

The register groups activities by where they stand: those in the record of processing, those in preparation, and those closed.