Art.29 Processing under the authority of the controller or processor
The processor, and any person acting under the authority of the controller or of the processor who has access to personal data, must not process that data except on instructions from the controller, unless required to do
5
artefacts
1
held by a system
1
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Monitoring or logging capable of detecting processing outside instruction, and records of any detection · SIEM / log platform
periodic reviewEvidence produced at each review
- Where a legal requirement overrides instructions, the record of the requirement and the notification given to the controller · Document repository
governing documentDocuments that govern the control
- The documented instructions issued to each processor, and the mechanism by which they are kept current · Document repository
- Employment or contract terms binding staff and contractors to process personal data only as instructed · Vendor register / contract repository
- Access controls that make the technical scope of access match the instructions actually given · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your SIEM / log platform on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Instructions existing only as the original contract, never updated as the processing changed over years of service
- Staff holding broad standing access to production personal data far beyond what their instructed tasks require
- No means of detecting processing outside instruction, so the obligation is asserted and never tested
- Processor use of controller data for its own purposes, such as service improvement or model training, permitted by a clause nobody negotiated
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet