Art.11 Processing which does not require identification
Where the purposes of processing do not or no longer require the controller to identify the data subject, the controller is not obliged to maintain, acquire or process additional information solely in order to comply wit
4
artefacts
0
held by a system
0
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Analysis of which datasets are processed without the ability to identify the individual, and the basis for that conclusion · Document repository
- The documented position on why additional identifying information is not held, showing it was not discarded to avoid rights requests · Document repository
- The response given to a data subject whose request cannot be met for want of identification, including the invitation to supply identifying information · Policy repository / GRC workspace
- The procedure for accepting and using additional information a data subject supplies to enable identification · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Article 11 claimed for data that is in fact linkable through a device identifier, an account key or a join with another held dataset
- The data subject never informed that the controller cannot identify them, so the request simply goes unanswered
- Additional identifying information supplied by a data subject refused or ignored rather than used to service the right
- Extra identifiers demanded from every requester as a matter of routine, which is the opposite of what the Article permits
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.10 Processing of personal data relating to criminal convictions · Art.12 Transparent information, communication and modalities for rights