Personal data processing is a huge part of any business. It’s used to automate processes, communicate with customers and employees, and analyse past performance.
To be GDPR compliant, you need to keep a record of all processing activities. This article will guide you through creating that internal record so that you can prove your accountability to supervisory authorities.
Data Mapping and Inventory
Having a complete, granular view of personal data is essential for ensuring transparency and accountability. It’s also the best way to assess if your organization has a legal basis for processing it.
The data mapping process is a complicated undertaking, often involving multiple departments across the company (marketing, HR, web development, etc.). It’s important to find a partner that can help you build this map with ease and accuracy, while supporting the full breadth of personal data your business processes.
An accurate, comprehensive data map is the first step in implementing an internal accountability mechanism required by Article 30 of GDPR. This will enable you to fulfill requests to access and delete personal data in a timely manner, while demonstrating the necessary transparency and thoroughness that privacy law demands.
Purpose of Data Processing
One of the most important purposes of privacy laws is to bring transparency and accountability into data processing. However, this is hard to accomplish without detailed documentation of what data is being collected, why, where and when.
That’s why Article 30 of the GDPR requires organisations to keep records and overviews of personal data processing activities which are made available upon request to supervisory authorities. The documentation also covers data categories, data recipients, purpose of processing and a description of the security measures in place.
The initial compilation and ongoing maintenance of RoPA can be time consuming. It ties up resources especially for large-scale companies that process a lot of different types of personal data. But this documentation is essential for self-auditing and identifying gaps or opportunities to improve or enhance processes.
Data Categories and Types
The GDPR obligates firms that process personal data to keep thorough records of their processing practices, known as a record of processing activities (RoPA). These documents should be readily available to authorities upon request.
In practice, the only way to create a RoPA that is meaningful and useful is to danh gia tac dong xu ly du lieu ca nhan break down your business operations into areas that are homogenous in terms of the type of personal data processed within them. This might include business functions such as HR, sales and marketing or it might involve geographical locations such as a warehouse or manufacturing facility.
Then, consider which lawful bases you use to process each set of data. This will help you differentiate between data sets so that you can provide granular responses to requests for access by data subjects.
Data Flow Analysis
Data flow analysis is a method of documenting the source, storage, and destinations of personal data in an organization. It is similar to a Data Protection Impact Assessment (DPIA), although they serve different purposes and functions.
A granular data flow analysis helps with the creation of records of processing activities, which are a requirement for many organizations under GDPR Article 30 and a best practice for all of them. These records should include details of the purpose, legal basis, consent status, and cross-border transfers.
Additionally, a granular data flow analysis can identify opportunities for constant folding and other optimization techniques and help detect potential bugs. Lastly, it is an important tool for incident response and management. For example, when a security breach occurs, data flow analysis can quickly determine the affected data and what measures to take.
Data Subjects and Consent
Data Subjects are individuals about whom personal information is processed. They have a number of rights, including the right to request access to their data and the right to have it corrected or erased.
Consent is one of the lawful bases for processing data, but it must be freely given and specific. It must also be clear and informed. Consent must be explicit and can’t be a default option when someone provides an email address or checks a box on a form.
If a data subject refuses or withdraws their consent, you must stop using their personal information (unless another legal basis is in place). You must keep records of the decision and any withdrawals of consent. You must also inform them of any other lawful bases for processing their data.