prudenceby Runciter

Governance and inventory

Approve and activate a processing activity

Submit an activity for review, and block activation where critical answers, conditional assessments, agreements or approvals are missing.

A processing activity is only as trustworthy as the discipline behind its approval. A finance team introducing a new payroll provider cannot let the activity reach In use on the strength of a single person's say so; it has to pass through review with the outstanding items visible to whoever confirms the step.

Prudence enforces this by refusing the destination state, not by warning and allowing it anyway. A DPIA left unconcluded, or an agreement never attached to the processor, stops the transition at the door.

The proof is a record whose history shows who approved it, when, and against what remaining gaps, none.

Regulation
Articles 5(2), 24 and 25
Registers
Processing activity · DPIA · Agreement · Audit and review
The state rail, offering the next step available from the current state.
The state rail, offering the next step available from the current state.

The steps

  1. 01Open the activity and use the state rail at the top of the record to choose the next step, for example Legal review to Approved.
  2. 02Read the confirmation panel that opens, which separates required answers from expected ones.
  3. 03Complete any required answer directly in the panel without closing the record.
  4. 04Name the approver and the date of the decision in the fields provided.
  5. 05Confirm the step.
  6. 06Repeat the process for the step from Approved to In use once operational readiness is confirmed.
  7. 07Open the audit trail on the record to check the approver and the date were written to the history.
Confirming a step. Required answers are separated from expected ones and can be completed here.
Confirming a step. Required answers are separated from expected ones and can be completed here.

Accepted when

  • An activity cannot reach In use while a required assessment is unconcluded.
  • The audit trail holds who approved it and when.
The audit trail, holding the approver and the date of each step taken.
The audit trail, holding the approver and the date of each step taken.

Documents that carry the evidence

DPIA · Data protection impact assessment
The description, the necessity and proportionality test, the risks to individuals and the measures adopted. Article 35.
LIA · Legitimate interests assessment
The purpose, necessity and balancing test relied upon where processing rests on Article 6(1)(f).

These templates are issued when the register opens, so the document exists before the record that cites it.