prudenceby Runciter

Reference

Every register, and the article that asks for it

These registers constitute the product. Nothing here is sector specific. One structure serves a controller with a single office and a processor operating across several member states.

Processing

The Article 30 register of processing activities.

Processing activities

Article 30(1) and 30(2). The atomic unit of the Record of Processing Activities.

A processing activity recorded under Article 30.

Lifecycle

  1. Draft
  2. Legal review
  3. Approved
  4. In use
  5. Suspended
  6. Retired

Fields

Special category data is processed

Criminal conviction or offence data

Owner *

Processing purpose *

Specific purpose *

Processing operations

Source of the personal data *

Joint controller arrangement reference

Involves a transfer outside the Union *

Data subject categories *

Personal data categories *

Lawful basis *

Article 9 condition (conditional)

Article 10 authority (conditional)

Consent mechanism (conditional)

DPIA required

Decision to proceed without a concluded assessment

Processing started on

Retention rule

Retention trigger

Deletion method

Categories of recipients

Next review date

Review trigger

Suspension reason

Special categories present (conditional)

Safeguards for this data

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Governance

Who is accountable, and the documents that evidence it.

Entities

Articles 4(7), 4(8), 26, 27, 28, 37 to 39.

A controller, joint controller, processor, subprocessor, recipient, Data Protection Officer, representative or authority.

Lifecycle

  1. Identified
  2. In negotiation
  3. Active
  4. Suspended
  5. Terminated

Fields

Owner *

Entity role *

Legal name *

Country of establishment

Supervisory authority of establishment

Article 27 representative

Contact details *

Basis for the Data Protection Officer appointment (conditional)

Agreement status

Audit and inspection rights (conditional)

Certification or code of conduct relied upon

Effective date

Review date

Subprocessors permitted (conditional)

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Documents

Articles 5(2), 12 to 14, 24, 28(3), 30, 35, 46, 47.

A data protection document such as a DPIA, LIA, TIA, privacy notice, agreement, policy or retention schedule.

Lifecycle

  1. Draft
  2. Under review
  3. Approved
  4. Active
  5. Superseded
  6. Expired
  7. Retired

Fields

Special category data is processed

Criminal conviction or offence data

Owner *

Document type *

Version *

Approver

Approval date

Effective date

Expiry date

Review date

Legal review status

Where this document is published (conditional)

Retention period for this document

Assessment outcome (conditional)

Residual risk (conditional)

Processor and subject-matter input (conditional)

Advice of the Data Protection Officer (conditional)

Views of data subjects, or why they were not sought (conditional)

Advice that was not followed (conditional)

Justification for departing from that advice (conditional)

Decision of the controller (conditional)

Who took the decision for the controller (conditional)

Date of the decision (conditional)

Position on prior consultation (conditional)

Summary

Special categories present (conditional)

Article 9(2) condition (conditional)

Article 10 authority (conditional)

Safeguards for this data

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Consent records

Articles 7, 8.

Evidence that consent was given, for what wording, and how it can be withdrawn.

Lifecycle

  1. Active
  2. Expired
  3. Withdrawn
  4. Superseded

Fields

Special category data is processed

Criminal conviction or offence data

Consent reference *

Consent statement version *

Wording presented to the data subject *

Purposes this consent covers *

Separate options offered for each purpose

Language presented in

Collection method *

Consent collected at *

Withdrawal method *

Withdrawal as easy as giving consent *

Withdrawal date

Evidence

Special categories present (conditional)

Article 9(2) condition (conditional)

Article 10 authority (conditional)

Safeguards for this data

Owner *

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Transfer records

Chapter V, Articles 44 to 49. Schrems II and EDPB Recommendations 01/2020.

A transfer of personal data to a third country or international organisation.

Lifecycle

  1. Identified
  2. Under assessment
  3. Active
  4. Suspended
  5. Ended

Fields

Special category data is processed

Criminal conviction or offence data

Owner *

Exporter country *

Exporter role *

Importer country *

Importer role *

Transfer mechanism *

SCC module (conditional)

TIA required *

TIA conclusion date (conditional)

Derogation relied upon (conditional)

Onward transfers permitted

Supplementary measures

Personal data categories *

Effective date

Review date

Suspension reason

Special categories present (conditional)

Article 9(2) condition (conditional)

Article 10 authority (conditional)

Safeguards for this data

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Operations

Open matters with a statutory or internal deadline.

Audits and reviews

Articles 24(1), 32(1)(d), 39(1)(b).

A planned or completed audit, review or supervisory engagement.

Lifecycle

  1. Planned
  2. In progress
  3. Reporting
  4. Closed
  5. Cancelled

Fields

Owner *

Review type *

Review scope *

Review criteria

Planned date *

Completion date

Review outcome

Review findings

Next review date

Evidence

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Data subject requests

Articles 12 to 22. Statutory deadline tracking.

A data subject rights request under Chapter III.

Lifecycle

  1. Received
  2. Identity verification
  3. In progress
  4. Response review
  5. Completed
  6. Refused
  7. Withdrawn

Fields

Special category data is processed

Criminal conviction or offence data

Owner *

Request type *

Subject reference *

Channel received through *

Received at *

Statutory deadline

Extended deadline

Extension reason

Identity verification *

Recipients notified (Art 19)

Third party data decision (conditional)

Basis for refusal or fee

Response authorised by

Response summary

Refusal grounds

Special categories present (conditional)

Article 9(2) condition (conditional)

Article 10 authority (conditional)

Safeguards for this data

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Data breaches

Articles 4(12), 33, 34.

A personal data breach record with the seventy-two hour notification clock.

Lifecycle

  1. Detected
  2. Triage
  3. Under investigation
  4. Notification decision
  5. Remediation
  6. Closed

Fields

Special category data is processed

Criminal conviction or offence data

Owner *

Breach type *

Cause

Detected at *

Notification deadline

Occurred at

Processor notification received at

Affects data subjects in more than one member state *

Authority notified

Reason for notifying after seventy-two hours

Internal breach record complete

Data subject categories

Personal data categories

Approximate individuals affected

Risk to individuals *

Authority notification required (Art 33) *

Individual communication required (Art 34) *

Authority notified at

Individuals communicated at

Decision rationale

Closure evidence

Special categories present (conditional)

Article 9(2) condition (conditional)

Article 10 authority (conditional)

Safeguards for this data

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Privacy actions

Article 5(2) accountability. The mechanism that closes a gap.

An owned, dated remediation task raised from a finding or a review.

Lifecycle

  1. Open
  2. In progress
  3. Blocked
  4. Completed
  5. Cancelled

Fields

Owner *

Category *

Priority

Due date *

Raised from

Reason work cannot continue

Completion evidence

Verification result

Verified by

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Risk and security

Identified risks and the measures that address them.

Risks

Articles 24(1), 25(1), 32(1), 35(7)(c) and Recitals 75 to 77, with the privacy risk assessment and treatment clauses of ISO/IEC 27701 (clause 6.1).

One uncertain event, assessed for its consequence for data subjects and for the organisation, treated by measures and monitored or accepted with authority.

Lifecycle

  1. Identified
  2. Under assessment
  3. Treatment required
  4. Treatment in progress
  5. Awaiting acceptance
  6. Monitored
  7. Accepted
  8. Closed

Fields

Special category data is processed

Criminal conviction or offence data

Owner *

Risk statement *

Contributing condition or weakness

Risk event

Risk scenario type *

Where this risk came from *

Risk category

Risk family

Risk scope

Personal data categories at risk *

Consequences for data subjects

Consequences for the organisation

Harm to data subjects

Scale of the affected population

Vulnerable data subjects are affected

Why they are vulnerable (conditional)

Assessor

Data protection officer consulted

Advice of the data protection officer (conditional)

Assessment methodology version

Inherent likelihood *

Inherent impact on data subjects

Why data subjects cannot be affected (conditional)

Inherent impact on the organisation

Dimensions that carry that impact

Likely to result in high risk to rights and freedoms

Reasons for that conclusion

Impact assessment position

Assumptions and what is not known

Rating recorded instead of the calculated one

Reason for departing from the calculated rating (conditional)

Treatment strategy

Reasons for the treatment decision

Target date for the treatment

Conclusion on the effectiveness of the measures

Evidence of effectiveness

Date effectiveness was confirmed

Residual likelihood after the measures

Residual impact on data subjects

Residual impact on the organisation

Residual high risk to data subjects remains

Prior consultation under Article 36 (conditional)

Reasons for accepting the residual risk

Acceptance expires on

Severity for the data subject, previous methodology

Identified on

Last assessed

Assessment currency

What triggered the review (conditional)

Review frequency

Next review date

Requirements this risk bears on

Reasons for closing the risk

Special categories present (conditional)

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Technical and organisational measures

Articles 24(1), 25, 32.

A technical or organisational measure and its tested effectiveness.

Lifecycle

  1. Proposed
  2. Implemented
  3. Verified
  4. Ineffective
  5. Retired

Fields

Owner *

Measure type *

Article 32(1) category *

Where this measure applies *

Description *

Effectiveness

Last tested

Next review date

Test method

Evidence

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Resources

The reference records that other registers cite.

Resources

Articles 5(1)(f), 30, 32. The master data everything else refers to.

A system, application, database, location, device or third-party service that processing depends on.

Lifecycle

  1. Identified
  2. Active
  3. Being decommissioned
  4. Decommissioned

Fields

Owner *

Resource type *

Provider

Role in the processing *

Hosting or storage location

Primary country

Data residency

Security classification

Access control model *

Personal data reachable by a subprocessor *

Backup location

Evidence that deletion works

Retention or deletion capability

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Data subject sets

Articles 30(1)(c), 8, 12 and 35(1). Categories of data subject, held as master data rather than retyped per activity.

A named population of people whose personal data is processed, held once and referred to by every activity that concerns it.

Lifecycle

  1. Identified
  2. Confirmed
  3. Under change
  4. Retired

Fields

Special category data is processed

Criminal conviction or offence data

Owner *

Who is in the set *

Data subject categories *

Includes children *

Age or consent verification (conditional)

Includes vulnerable individuals *

Lawful basis relied upon for children (conditional)

Approximate volume

Geographic scope

Subject to automated decision-making *

How this set is informed *

Review date

Special categories present (conditional)

Article 9(2) condition (conditional)

Article 10 authority (conditional)

Safeguards for this data

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.