Art.5 Principles relating to processing of personal data
Process personal data lawfully, fairly and in a transparent manner; collect it for specified, explicit and legitimate purposes and do not process it further in a way incompatible with those purposes; keep it adequate, re
6
artefacts
1
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Assurance output that demonstrates compliance rather than asserts it, such as control testing, internal audit or DPO reporting · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Accuracy controls: how inaccurate data is detected, and records of rectification or erasure carried out without delay · Document repository
- The compatibility assessment for any further processing carried out for a new purpose · Document repository
governing documentDocuments that govern the control
- The purpose recorded for each processing activity, stated specifically enough that a later use can be tested against it · Document repository
- Retention schedule per data category with the criteria that set each period, and deletion evidence showing the schedule actually runs · Policy repository / GRC workspace
- Minimisation analysis per collection point showing why each field is necessary for the stated purpose · Document repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Policy repository / GRC workspace on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Purposes written so broadly, for example business purposes or service improvement, that no later use could ever be incompatible with them
- Retention periods published in a policy but implemented in no system, so data is in fact kept indefinitely
- Accountability treated as holding the documents rather than being able to show the principles were applied
- Minimisation never revisited after launch, so fields added for a discontinued feature keep being collected
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet