Art.13 Information to be provided where personal data are collected
Where personal data is collected from the data subject, provide at the time it is obtained the identity and contact details of the controller and any representative, the contact details of the data protection officer, th
5
artefacts
2
held by a system
0
at each review
moderate
to go live
Data governance / DLP tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- The published description of automated decision-making logic, and the reasoning for why it is meaningful to a data subject · Data governance / DLP tooling
- Records showing new purpose information was given before the further processing started, with dates · Document repository
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- The privacy notice mapped item by item against every information element Article 13 lists · Policy repository / GRC workspace
- Evidence of the point and timing at which the notice is presented for each collection channel, including forms, telephone and in person · Policy repository / GRC workspace
- The storage periods or criteria as published, reconciled against the actual retention schedule · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Data governance / DLP tooling); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Recipients described only as third parties or trusted partners, which names neither a recipient nor a category
- Retention shown as for as long as necessary, which is neither a period nor a criterion
- The notice linked from a page footer but not presented at the point of collection, so it is not provided at the time the data is obtained
- Automated decision-making logic described in terms that would fit any system, leaving the data subject nothing to contest
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.12 Transparent information, communication and modalities for rights · Art.14 Information where personal data have not been obtained from the data subject