New service: Our questionnaire for documenting processing activities in accordance with Art. 30 GDPR

The General Data Protection Regulation (GDPR) requires companies and organisations to keep detailed records of all processes involving the processing of personal data. This is done to ensure transparency and traceability and to be able to demonstrate compliance with data protection regulations to supervisory authorities and data subjects. The central element of this documentation is the so-called ‘record of processing activities’ in accordance with Art. 30 GDPR.

Why is the documentation necessary?

• It serves as proof (‘accountability’) that the principles of the GDPR (lawfulness, transparency, data minimisation, integrity, confidentiality, etc.) are being complied with.

• Authorities can request and check this register at any time.

• In the event of data protection incidents, the documentation can help to clarify the situation.

• It helps to control internal data protection processes and identify potential for optimisation.
   

Contents of the documentation on processing activities

According to the GDPR, the directory must contain the following information:

• Name and contact details of the responsible person and, if applicable, the representative and the data protection officer.

• Purpose(s) of the processing.

• Description of the categories of data subjects and personal data.

• Categories of recipients to whom the data is disclosed.

• Information on transfers to third countries (including documentation of appropriate safeguards).

• Planned time limits for erasure of the data (types).

• General description of the technical and organisational measures for data protection.

List: Information that the document must contain about the author

In order for a processing activities register to comply with legal requirements, it must contain the following information about the ‘author’ (i.e. the responsible creator/company):

• Full name of the responsible party (company/organisation/individual)

• Contact details of the responsible party (address, email, telephone number)

• If applicable, name and contact details of a representative of the responsible party (for branches outside the EU)

• (If named) Name and contact details of the data protection officer

This information is important because it ensures accountability and provides a means of contact for authorities and affected persons.

Conclusion:

Careful documentation of all processing activities is a core component of GDPR compliance, supports transparency and serves as protection for companies in the event of inquiries from authorities or data protection incidents. The information about the author clarifies who is actually responsible for data protection compliance.

Our new, free questionnaire supports you in creating this documentation. You can be documented in just a few steps. 
(Our questionnaire is available in German)