Application to manage recording of processing activities

Application to manage recording of processing activities

In order to offer support, mainly to small organisations (data controllers), the Catalan Data Protection Authority has designed an application to create, maintain and manage the processing activities record. This application is only an example. 

The GDPR provides certain obligations for controllers and processors to maintain documentation of processing activities. In accordance with Article 30.1 of the Regulation, each controller and, where applicable, the controller's representative, must maintain a record of processing activities carried out under its responsibility. Though Article 30.2 of the GDPR states that data processors are also bound by this obligation, the application is currently designed for use by controllers. 

This obligation does not apply to the controllers or processors of an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of personal data or personal data relating to criminal convictions and offences. 

Besides being an obligation for data controllers, the keeping of these records of processing activities demonstrates conformity and accredits compliance with the GDPR (the accountability principle). 

The application enables different processing activities to be registered and modified, as well as their deregistration when necessary. It also allows a document to be produced stating the processing activities that have been included in the record, which may be published if necessary. 

The application developed by the Catalan Data Protection Authority also provides for the possibility of adding other information, in addition to what Article 30.1 of the GDPR establishes as compulsory, to the processing activities record. In this case, the fields may be filled in or left blank.