Risk and controls

Assess a material processing change

Evaluate a change to purpose, data, systems, recipients, suppliers, locations or technology, and identify which linked records need revision and whether reapproval is required.

When a payment provider migrates its processing to a new data centre outside the European Economic Area, that single change touches the transfer record, the agreement, the notice and possibly the DPIA of every activity it supports. The change has to be recorded once and traced across all of them.

This is exercised on the affected activity itself, using the linked records band as the map of everything the change might disturb.

The proof is that the affected records are listed rather than searched for, and that a material change returns the activity to an unapproved state until it is reviewed again.

Regulation

Articles 5(2), 24, 25 and 35(11)

Registers

Processing activity · DPIA · Privacy notice · Agreement · Record of processing

The steps

1. 01Open the activity affected and record the change on the Details tab.
2. 02Open the Linked records band and read what the change touches.
3. 03For each affected record, open it directly from the band and note the required revision.
4. 04Where the change is material, use the state rail to return the activity from In use to Legal review.
5. 05Confirm the record of processing view no longer lists the activity until it is reapproved.

Accepted when

• The linked records affected are listed, not searched for.
• A material change returns the record to an unapproved state.