prudenceby Runciter

Reference

Every register, and the article that asks for it

These registers constitute the product. Nothing here is sector specific. One structure serves a controller with a single office and a processor operating across several member states.

Processing

The Article 30 register of processing activities.

Processing activities

Article 30(1) and 30(2). The atomic unit of the record of processing activities.

A processing activity recorded under Article 30.

Lifecycle

  1. Draft
  2. Legal review
  3. Approved
  4. In use
  5. Suspended
  6. Retired

Fields

Special category data is processed

Criminal conviction or offence data

Owner *

Processing purpose *

Specific purpose *

Processing operations

Source of the personal data *

Joint controller arrangement reference

Involves a transfer outside the Union *

Data subject categories *

Personal data categories *

Lawful basis *

Article 9 condition (conditional)

Article 10 authority (conditional)

Consent mechanism (conditional)

DPIA required *

Decision to proceed without a concluded assessment

Processing started on

Retention rule

Retention trigger

Deletion method

Categories of recipients

Next review date

Review trigger

Suspension reason

Special categories present (conditional)

Safeguards for this data

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Governance

Who is accountable, and the documents that evidence it.

Entities

Articles 4(7), 4(8), 26, 27, 28, 37 to 39.

A controller, joint controller, processor, subprocessor, recipient, data protection officer, representative or authority.

Lifecycle

  1. Identified
  2. In negotiation
  3. Active
  4. Suspended
  5. Terminated

Fields

Owner *

Entity role *

Legal name *

Country of establishment

Supervisory authority of establishment

Article 27 representative

Contact details *

Basis for the data protection officer appointment (conditional)

Agreement status

Audit and inspection rights (conditional)

Certification or code of conduct relied upon

Effective date

Review date

Subprocessors permitted (conditional)

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Documents

Articles 5(2), 12 to 14, 24, 28(3), 30, 35, 46, 47.

A data protection document such as a DPIA, LIA, TIA, privacy notice, agreement, policy or retention schedule.

Lifecycle

  1. Draft
  2. Under review
  3. Approved
  4. Active
  5. Superseded
  6. Expired
  7. Retired

Fields

Special category data is processed

Criminal conviction or offence data

Owner *

Document type *

Version *

Approver

Approval date

Effective date

Expiry date

Review date

Legal review status

Where this document is published (conditional)

Retention period for this document

Assessment outcome (conditional)

Residual risk (conditional)

Summary

Special categories present (conditional)

Article 9(2) condition (conditional)

Article 10 authority (conditional)

Safeguards for this data

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Consent records

Articles 7, 8.

Evidence that consent was given, for what wording, and how it can be withdrawn.

Lifecycle

  1. Active
  2. Expired
  3. Withdrawn
  4. Superseded

Fields

Special category data is processed

Criminal conviction or offence data

Consent reference *

Consent statement version *

Wording presented to the data subject *

Purposes this consent covers *

Separate options offered for each purpose

Language presented in

Collection method *

Consent collected at *

Withdrawal method *

Withdrawal as easy as giving consent *

Withdrawal date

Evidence

Special categories present (conditional)

Article 9(2) condition (conditional)

Article 10 authority (conditional)

Safeguards for this data

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Transfer records

Chapter V, Articles 44 to 49. Schrems II and EDPB Recommendations 01/2020.

A transfer of personal data to a third country or international organisation.

Lifecycle

  1. Identified
  2. Under assessment
  3. Active
  4. Suspended
  5. Ended

Fields

Special category data is processed

Criminal conviction or offence data

Owner *

Exporter country *

Exporter role *

Importer country *

Importer role *

Transfer mechanism *

SCC module (conditional)

TIA required *

TIA conclusion date (conditional)

Derogation relied upon (conditional)

Onward transfers permitted

Supplementary measures

Personal data categories *

Effective date

Review date

Suspension reason

Special categories present (conditional)

Article 9(2) condition (conditional)

Article 10 authority (conditional)

Safeguards for this data

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Operations

Open matters with a statutory or internal deadline.

Audits and reviews

Articles 24(1), 32(1)(d), 39(1)(b).

A planned or completed audit, review or supervisory engagement.

Lifecycle

  1. Planned
  2. In progress
  3. Reporting
  4. Closed
  5. Cancelled

Fields

Owner *

Review type *

Review scope *

Review criteria

Planned date *

Completion date

Review outcome

Review findings

Next review date

Evidence

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Data subject requests

Articles 12 to 22. Statutory deadline tracking.

A data subject rights request under Chapter III.

Lifecycle

  1. Received
  2. Identity verification
  3. In progress
  4. Response review
  5. Completed
  6. Refused
  7. Withdrawn

Fields

Special category data is processed

Criminal conviction or offence data

Owner *

Request type *

Subject reference *

Channel received through *

Received at *

Statutory deadline

Extended deadline

Extension reason

Identity verification *

Recipients notified (Art 19)

Third party data decision (conditional)

Basis for refusal or fee

Response authorised by

Response summary

Refusal grounds

Special categories present (conditional)

Article 9(2) condition (conditional)

Article 10 authority (conditional)

Safeguards for this data

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Data breaches

Articles 4(12), 33, 34.

A personal data breach record with the seventy-two hour notification clock.

Lifecycle

  1. Detected
  2. Triage
  3. Under investigation
  4. Notification decision
  5. Remediation
  6. Closed

Fields

Special category data is processed

Criminal conviction or offence data

Owner *

Breach type *

Cause

Detected at *

Notification deadline

Occurred at

Processor notification received at

Affects data subjects in more than one member state *

Authority notified

Reason for notifying after seventy-two hours

Internal breach record complete

Data subject categories

Personal data categories

Approximate individuals affected

Risk to individuals *

Authority notification required (Art 33) *

Individual communication required (Art 34) *

Authority notified at

Individuals communicated at

Decision rationale

Closure evidence

Special categories present (conditional)

Article 9(2) condition (conditional)

Article 10 authority (conditional)

Safeguards for this data

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Privacy actions

Article 5(2) accountability. The mechanism that closes a gap.

An owned, dated remediation task raised from a finding or a review.

Lifecycle

  1. Open
  2. In progress
  3. Blocked
  4. Completed
  5. Cancelled

Fields

Owner *

Category *

Priority

Due date *

Raised from

Reason work cannot continue

Completion evidence

Verification result

Verified by

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Risk and security

Identified risks and the measures that address them.

Risks

Articles 24(1), 25(1), 32(1), 35(7)(c) and Recitals 75 to 77.

An identified risk to the rights and freedoms of data subjects, rated before and after the measures that address it.

Lifecycle

  1. Identified
  2. Under assessment
  3. Treatment approved
  4. Treated
  5. Accepted
  6. Closed

Fields

Special category data is processed

Criminal conviction or offence data

Owner *

Risk statement *

Risk source *

Personal data categories at risk *

Likelihood *

Severity for the data subject *

Inherent rating

Residual rating after measures

Treatment decision *

Justification for the decision

Next review date

Special categories present (conditional)

Article 9(2) condition (conditional)

Article 10 authority (conditional)

Safeguards for this data

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Technical and organisational measures

Articles 24(1), 25, 32.

A technical or organisational measure and its tested effectiveness.

Lifecycle

  1. Proposed
  2. Implemented
  3. Verified
  4. Ineffective
  5. Retired

Fields

Owner *

Measure type *

Article 32(1) category *

Where this measure applies *

Description *

Effectiveness

Last tested

Next review date

Test method

Evidence

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Resources

The reference records that other registers cite.

Resources

Articles 5(1)(f), 30, 32. The master data everything else refers to.

A system, application, database, location, device or third-party service that processing depends on.

Lifecycle

  1. Identified
  2. Active
  3. Being decommissioned
  4. Decommissioned

Fields

Owner *

Resource type *

Provider

Role in the processing *

Hosting or storage location

Primary country

Data residency

Security classification

Access control model *

Personal data reachable by a subprocessor *

Backup location

Evidence that deletion works

Retention or deletion capability

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.

Data subject sets

Articles 30(1)(c), 8, 12 and 35(1). Categories of data subject, held as master data rather than retyped per activity.

A named population of people whose personal data is processed, held once and referred to by every activity that concerns it.

Lifecycle

  1. Identified
  2. Confirmed
  3. Under change
  4. Retired

Fields

Special category data is processed

Criminal conviction or offence data

Owner *

Who is in the set *

Data subject categories *

Includes children *

Age or consent verification (conditional)

Includes vulnerable individuals *

Lawful basis relied upon for children (conditional)

Approximate volume

Geographic scope

Subject to automated decision-making *

How this set is informed *

Review date

Special categories present (conditional)

Article 9(2) condition (conditional)

Article 10 authority (conditional)

Safeguards for this data

Approver

Author

Files and links

Organised across Details, Context, Accountability, Assessment, Lifecycle, Evidence.