Under the General Data Protection Regulation (GDPR, known in Dutch as the AVG), organisations are required to maintain up to date and accurate privacy management. In practice, this means that organisations must at all times be able to demonstrate what data they hold, for what purposes they use it and what measures they have taken to secure it.
It starts with a record of processing activities
Managing personal data and privacy starts with mapping all the data your organisation holds. This is what the record of processing activities is for. Almost all organisations are required to keep such a record; the obligation is set out explicitly in the GDPR.
Privacy Direct helps organisations set up and maintain the legally required record of processing activities, so that you continue to comply with the strict privacy rules.
Why does privacy management matter?
The supervisory authority, in the Netherlands the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), can take enforcement action and require you to provide insight into your privacy management. If you cannot demonstrate what you have done, you may face fines. These can run into millions of euros, depending on your turnover, the seriousness of the infringement and its duration.
Template or Privacy Management Software
Depending on the size of your organisation, you may be able to set up privacy management yourself, sometimes with an Excel file. Once you process more personal data, or data classed as special categories of personal data, we recommend Privacy Management Software. We work with several suppliers and recommend the solution that best suits you. This saves you a great deal of research and uncertainty. We offer various subscriptions for this service.
The subscription combines well with:
- Data Protection Officer as a service;
- the Privacy Helpdesk, your first point of call for privacy questions and document reviews;
- first aid for data breaches, including notification to and handling with the supervisory authority;
- privacy audits, assessments and reports on the GDPR and related legislation.
What goes into the record of processing activities?
The GDPR distinguishes between a controller and a processor. As a controller, you include the following in the record:
| Element | What do you include? |
|---|---|
| Name and contact details | Of your organisation or representative, organisations with which you jointly determine purposes and means, the DPO (Data Protection Officer) and international organisations with which you share data. |
| Purposes | The purposes of the processing, such as recruitment and selection, delivering products or direct marketing. Tip: also state the legal basis, as this helps with your accountability obligation. |
| Data subjects | The categories of individuals, such as customers, patients or benefit recipients. |
| Personal data | The categories of data, such as BSN (Dutch citizen service number), name and address details, telephone numbers, camera footage or IP addresses. |
| Retention period | The date by which you must erase the data, if known. |
| Recipients | The categories of recipients to whom you disclose personal data. |
| Outside the EU | Whether you share data with a country or international organisation outside the EU. |
| Security | A general description of the technical and organisational measures. |
Frequently asked questions
Is a record of processing activities mandatory?
Under Article 30 of the GDPR, almost all organisations are required to keep a record of processing activities.
Can I keep the record of processing activities in Excel?
For smaller organisations, an Excel template may be sufficient. If you process larger volumes of personal data or special categories of personal data, we recommend Privacy Management Software.