Art.30 Records of processing activities
Maintain a written, including electronic, record of processing activities under the controller's responsibility containing the name and contact details of the controller, any joint controller, the representative and the
5
artefacts
1
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Version history showing when each entry was last reviewed and by whom · Document repository
periodic reviewEvidence produced at each review
- The record of processing activities in full, checked against the seven controller elements, or the four processor elements, the Article lists · Document repository
- Where the fewer than 250 persons exemption is claimed, the assessment against all three disqualifying conditions · Document repository
governing documentDocuments that govern the control
- Reconciliation of the record against a system inventory or data flow map, to show nothing is missing rather than that the entries read well · Policy repository / GRC workspace
- The transfer entries with the third country identified and the safeguard documentation referenced · Document repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Document repository on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Records written once during the implementation project and never updated against reality, so they describe systems long replaced and omit those adopted since
- Entries written at the level of a department or a system rather than a processing activity, which loses the purpose that everything else hangs off
- Erasure time limits left blank throughout on the where possible qualifier, while a retention schedule exists elsewhere in the organisation
- The small organisation exemption claimed on headcount alone, ignoring that regular non-occasional processing disqualifies it
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.29 Processing under the authority of the controller or processor · Art.31 Cooperation with the supervisory authority