7.4.2 Limit processing
The organization must limit processing of personal data to what is adequate, relevant and necessary for the identified purposes, managing that limitation through its information security and privacy policies with documen
5
artefacts
1
held by a system
0
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Compliance monitoring against the limitation, not merely its adoption · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Policy and procedures constraining processing to the identified purposes · Policy repository / GRC workspace
- Access entitlements demonstrably scoped to purpose rather than to job title · Policy repository / GRC workspace
- Disclosure rules limiting who outside the organization receives what · Document repository
- Storage periods set per purpose · Document repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your SIEM / log platform on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Broad internal access granted for convenience, so any employee can read any record
- Limitation stated in policy with no procedure that turns it into a configuration
- Secondary use for analytics or model training treated as within the original purpose without assessment
- Storage period set at the system level rather than per purpose, so the longest purpose governs everything
- Adoption evidenced while compliance is never monitored
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet