In order to comply with GDPR, the first thing you have to do is a record of all your data processing activities - we call it a processing index.
Get started with the processing index
In the records of your processing activities, you have to list the following information (Article 30 GDPR):
- name and contact details of the controller (= responsible person)
- if applicable: name and contact details of the controller's representative and data protection officer
- the purpose of the data processing:
accounting, marketing, newsletter, payroll, video surveillance, ... - legal justification
legal obligation, fulfilment of contract, legitimate interest of controller, consent, ... - data categories:
employees, clients, suppliers, interested people,...
and categories of personal data:
name, address, IP-address, birthdate, ... - categories of recipients:
hosting provider, cloud storage, external accountants, legal authorities, ... - if applicable: transfers of data to third countries or international organisations and suitable safeguards
- deleting deadlines for different data categories:
bookkeeping documents for 7 years, website interests for 1 year, ... - general description of technical and organisational security measures:
encryption, pseudonymisation, backup, access control, ...
This is a processing index you have to create and maintain in order to be compliant with EU GDPR because this is the basis for all further analysis, information and documentation.
If you are processing data for other companies, you are - in terms of GDPR - a processor on behalf of the original controller. In this case, you have to maintain a record of all processing activities you are carrying out on behalf of the controller. This processing index has to consist of the following content:
- name and contact details of processor
- name and contact details of controller on behalf of which the processor is acting
- if applicable: name and contact details of the representative and data protection officer
- categories of processing
- if applicable: transfers of data to third countries or international organisations and suitable safeguards
- general description of technical and organisational security measures
Processing index completed ... and now?
While creating and recording your activities, you will find out what kind of data you are processing. For GDPR, you have to ensure through technical and organisational measures (TOM) that this personal data is stored, transmitted, processed, ... in a safe way. Specially, if you are
- processing huge amounts of data or
- special categories of data (Article 9 GDPR) or
- there is a high risk for freedom and rights of natural persons
you need to implement a DPIA. In other cases, you have to conduct a DPIA if there is a high risk in a processing activitiy.
After completing the processing index, you also know with which processors you will have to make a contract to guarantee appropriate technical and organisational measures for data protection and safety.
You will also have to check all your public statements about data processing and you have to ensure that you are informing the people in advance whenever you collect or process their personal data. If you receive personal data from a third party, you have to inform people about the data processing activity before you process it for the first time - at least within a month.
