Art.10 Processing of personal data relating to criminal convictions
Process personal data relating to criminal convictions and offences, or related security measures, only under the control of official authority or where Union or Member State law authorises the processing and provides ap
5
artefacts
0
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Identification of where conviction and offence data is processed, including screening and vetting results and incident records · HR system / LMS
- Evidence the required safeguards are actually implemented rather than merely cited · Document repository
governing documentDocuments that govern the control
- The Union or Member State provision authorising the processing, and the safeguards that provision requires · Document repository
- Access restriction and retention applied specifically to this data, tighter than for ordinary personal data · Policy repository / GRC workspace
- Confirmation that no comprehensive register of convictions is maintained outside official authority · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Background screening results retained on the personnel file indefinitely after the hiring decision is made
- Reliance on the candidate's consent where national law, not consent, is the authorisation the Article requires
- Offence data captured in incident reports or free text fields and never treated as Article 10 data
- The authorising law identified but the specific safeguards it mandates never mapped to a control
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.9 Processing of special categories of personal data · Art.11 Processing which does not require identification