Records of 'Processing Activities'
Legislations and regulations such as the GDPR require you to maintain records of your processing activities (GDPR Article 30). The rationale is that the understanding of the data flows allows the justification of data processing.
A number of EU Data-Protection Authorities have released templates for small businesses, but filling templates can be misleading. There is a risk that a "template filling exercise" doesn't lead to a proper analysis of the data flows, justification of data processing and mitigation.
Bizoneo allow you to easily gather and document your processing activity, and generate reports to assist Management and the Data-Protection Officer. We also provide specific features to assist data-processors.
- Detailed records of processing activities
- Data description;
- Documentation of the lawful base to process the data
- Retention period;
- Document staff and contractor with access to the data
- Link to the organisation's assets
- Link to the organisation's data-processors (or controllers)
- Category of data processed
- Ability to document the six steps to justify "legitimate interest" based processing;
- Ability to document "consent" based processing;
- Ability to group processing activities into services
- Data flows between processing activities
- Document the compliance to the GDPR Article 5.1 principles for each activity or service
- Dashboard for management;
Assistance in breach handling
- The records of processing are mandatory in case of an investigation from a Data-Protection Supervisory Authority
Dedicated features for data-processors
- Ability to provide the documentation required to assist the proper completion of data-processing agreements;
- Handling of the data disposal register;
- Classification of records of processing activity (in line with ISO 27001 requirements);
- Ability to export in Word/PDF.
- Ability to add data classification attributes;
- Encryption at rest and in transit;