Processing activities
A processing activity recorded under Article 30.
- States
- Draft → Legal review → Approved → In use → Suspended → Retired
- Opens at
- Draft
- Answers
- 30 fields, of which 8 are required
Reference · 4.1
Registers and record types.
This page is generated from the schema the application runs on, so it cannot fall out of step with the screens. For each record type it states what the record is for, the states it passes through in order, and how many answers it holds.
Processing
The Article 30 register of processing activities.
Governance
Who is accountable, and the documents that evidence it.
Entities
A controller, joint controller, processor, subprocessor, recipient, Data Protection Officer, representative or authority.
- States
- Identified → In negotiation → Active → Suspended → Terminated
- Opens at
- Identified
- Answers
- 17 fields, of which 4 are required
Documents
A data protection document such as a DPIA, LIA, TIA, privacy notice, agreement, policy or retention schedule.
- States
- Draft → Under review → Approved → Active → Superseded → Expired → Retired
- Opens at
- Draft
- Answers
- 31 fields, of which 3 are required
Consent records
Evidence that consent was given, for what wording, and how it can be withdrawn.
- States
- Active → Expired → Withdrawn → Superseded
- Opens at
- Active
- Answers
- 22 fields, of which 9 are required
Transfer records
A transfer of personal data to a third country or international organisation.
- States
- Identified → Under assessment → Active → Suspended → Ended
- Opens at
- Identified
- Answers
- 25 fields, of which 8 are required
Operations
Open matters with a statutory or internal deadline.
Audits and reviews
A planned or completed audit, review or supervisory engagement.
- States
- Planned → In progress → Reporting → Closed → Cancelled
- Opens at
- Planned
- Answers
- 13 fields, of which 4 are required
Data subject requests
A data subject rights request under Chapter III.
- States
- Received → Identity verification → In progress → Response review → Completed → Refused → Withdrawn
- Opens at
- Received
- Answers
- 24 fields, of which 6 are required
Data breaches
A personal data breach record with the seventy-two hour notification clock.
- States
- Detected → Triage → Under investigation → Notification decision → Remediation → Closed
- Opens at
- Detected
- Answers
- 30 fields, of which 7 are required
Privacy actions
An owned, dated remediation task raised from a finding or a review.
- States
- Open → In progress → Blocked → Completed → Cancelled
- Opens at
- Open
- Answers
- 12 fields, of which 3 are required
Risk and security
Identified risks and the measures that address them.
Risks
One uncertain event, assessed for its consequence for data subjects and for the organisation, treated by measures and monitored or accepted with authority.
- States
- Identified → Under assessment → Treatment required → Treatment in progress → Awaiting acceptance → Monitored → Accepted → Closed
- Opens at
- Identified
- Answers
- 59 fields, of which 6 are required
Technical and organisational measures
A technical or organisational measure and its tested effectiveness.
- States
- Proposed → Implemented → Verified → Ineffective → Retired
- Opens at
- Proposed
- Answers
- 13 fields, of which 5 are required
Resources
The reference records that other registers cite.
Resources
A system, application, database, location, device or third-party service that processing depends on.
- States
- Identified → Active → Being decommissioned → Decommissioned
- Opens at
- Identified
- Answers
- 16 fields, of which 5 are required
Data subject sets
A named population of people whose personal data is processed, held once and referred to by every activity that concerns it.
- States
- Identified → Confirmed → Under change → Retired
- Opens at
- Identified
- Answers
- 21 fields, of which 7 are required