Creating Article 30-compliant processing

This article explains how to create a processing activity that is compliant with GDPR Article 30. It covers both data controllers and processors.

At any time, you can follow your progress by viewing your percentage of completion. When you have reached 100%, your processing activity is Article 30-compliant.

The following table gives you a quick idea of the information required to build an Article 30-compliant processing activity, with the differences for data controllers and processors. Use it as a reminder once you are familiar with the processing creation process. However, the first time you create a processing activity, we strongly advise you to read through the full article.

Before you get started

There are a few key points you should know when completing a processing activity. Take a quick look now, it will save you time later!

• When you open a processing activity in Article 30 mode, sections that are not required are grayed. If you nevertheless wish to complete some of these sections, hover the mouse over the section, click Activate for this processing, and complete the field. Completing grayed fields does not increase your completion percentage.

• You can add additional items that are not required, but each item added must be complete. For example, in the Data section, one category of personal data must be selected, along with its storage information. If you select an additional data category, you must provide the storage information for that data category as well, even though you were not required to add another data category. Otherwise you will not get the full completion percentage for that section.

• Adding additional items that are not required does not increase your completion percentage.

• Departments and contacts must be added to their respective repositories before you can add them to a processing activity. Areas must also be added to their repository first in order to select them.

• You can link third parties, software and sites to a processing activity during the completion process. However, we recommend that you add them to the relevant repositories before creating the processing activity, as it will save you some skipping back and forth between the sections!

• There is no Save button. At each stage your work is saved automatically.

How to create a processing activity

Ok, time to get started.

To create a processing activity:

1. In the sidebar, click Processing.

2. The Processing page is displayed. It lists all the processing activities of the entity.

3. The Article 30/Extended toggle button must be gray. If it is green, click the button to toggle to Article 30.

4. To create a processing activity there are two options:

• Create a processing activity from scratch: Click the Add processing button.

• Activate one of the industry-specific standard processing activities included in your GDPR software: Locate the processing activity, and in the Status column, click the Activate button.

5. The window that opens depends on your choice in the previous step. Both windows are very similar.

• If you clicked the Add processing button, the Add new processing window opens.

• If you activated a standard processing activity, the Activate processing window opens (shown below).

6. Do one of the following:

• If you are adding a new processing activity, in the Type and name field, select DC (Data Controller) or DP (Data Processor) and give the processing activity a name. Then, in the Area dropdown menu, select an area. The name and area can be changed later, but not the type.

• If you are activating a standard processing activity, the Type and name and Area fields are already populated.

 

7. As the current user, you are selected by default as both the Drafter and the Validator.

• To add other drafters and/or validators, click the respective fields and select a name from the dropdown list.

• To delete, click the “x” next to their name.

• You can change them later if required.

 

8. To create/activate the processing activity you have two options:

• Click the Create and stay on page / Activate and stay on page button. This creates/activates the processing activity and keeps you on the Processing page, allowing you to work on other processing activities.

• Click the Create and start editing / Activate and start editing button. This creates/activates the processing activity and opens it, allowing you to start completing it (shown below).

 

The processing activity now needs to be completed. Please continue to the next section.

How to complete an Article 30-compliant processing activity

This section describes each of the sections to be completed in order to create an Article 30-compliant processing activity. Seven sections are required for data controllers and five for processors.

Identification

1. In the sidebar, click Processing, locate the processing activity and click its name to open it.

2. The processing menu listing each section of the processing activity displays to the left. By default, you are in the Identification section. Check that the Article 30/Extended toggle button is gray (Article 30 selected).

The Identification page displays to the right. The Managers tab is open.

3. Click the Add a department or a person in charge button. This is where you will select the department or person to contact in your organization that is qualified to answer questions concerning the processing activity.

Do one of the following:

• To choose a department without designating a specific contact, in the Departments tab, select a department.

• To choose a specific person, click the Contacts tab and select the contact. The Department in charge column will be automatically populated with the contact’s department.

4. Do one of the following:

• Select one category of data subject.

• Enter the name of a personalized category in the Other field and click the Add button.

Purposes

1. In the Processing menu, click Purposes.

 

2. The Purposes page opens. Do one of the following:

• Enter a text description of the purposes in the text box.

• Click the Add value button and either select one of the proposed purposes or enter your own in the text field. If you are creating a new processing activity from scratch, no purposes are proposed and you must enter your own text.

3. Select at least one item beneath What is the legal basis for this processing.

Data

1. In the Processing menu, click Data.

2. The Data page opens. Select a data category, or use the Other field to enter a personalized data category and click the Add button.

3. A window opens, allowing you to enter data storage information for that category.

• Select manual or automatic erasure.

• Enter a Duration. Modify the time unit if required (the default is Month(s)).

• Select the Starting point. This is the moment when the “duration clock starts ticking”. If you select Other, you must describe the starting point in the text field provided.

Data subject rights

Recipients

This section allows you to select a data recipient that belongs to your organization, or is outside it.

1. In the Processing menu, click Recipients.

2. Do one of the following:

• To select an Internal recipient, click Add internal recipient and select a Department or a Contact.

• To select an external recipient, click the External tab and select a recipient using the Assign third party dropdown menu, or click the Add a third party button to create a new external recipient.

Cross-border flow

1. In the Processing menu, click Cross-border flow.

2. The Cross-border flow page opens. Do one of the following:

• If no personal data will be transferred outside the European Union, select No.

• If personal data will be transferred outside the European Union, select Yes. Then click the Add recipient dropdown menu to select the non-EU data recipient(s). You can add several recipients, but only one is required.

Once you have added the recipient, select an Appropriate safeguard from the dropdown menu.

Security measures

1. In the Processing menu, click Security measures.

2. The Security measures page opens. This page is designed to ensure:

• that any sites, software or hardware linked to the processing activity has at least 1 security measure

• that any hardware linked to the processing activity has a Type.

 

Sites

The Building access control measures tab allows you to link sites to the processing activity and add security measures.

• If you wish to link a site to the processing activity, click the Assign a site button, which redirects you to the Identification section. From there, use the Assign a site dropdown menu to select an existing site or create a new one (Add a site button).

• If one or more sites are already linked to the processing activity (via the Identification section), they are listed here.

• Whether the site was already linked to the processing activity or whether you do it now in this section, each linked site must have at least one internal OR one external security measure. To add a security measure to the site, click the Update measures link. Then click the Security measures tab. Click an Add value button to add an internal or external security measure to the site. (Click the Back arrow of your browser to return to the page.)

Software

The IT security measure tab allows you to link software to the processing activity and add security measures.

• If you wish to link software to the processing activity, click the Assign software button, which redirects you to the Identification section. From there, use the Assign software dropdown menu to select existing software or create a new one (Add a software button).

• If one or more software items are already linked to the processing activity (via the Identification section), they are listed here.

• Whether the software was already linked or whether you do it in this section, each software item must have at least one security measure. To add a security measure to the software, click the Update measures link. The Security tab opens. Click an Add value button to add a security measure to the software. (Click the Back arrow of your browser to return to the page.)

Hardware

Hardware can only be added via this section (it cannot be added via the Identification section). If you wish to add hardware:

1. Click the IT security measure tab and then click Add hardware.

2. In the Type field, enter a description of the hardware.

3. In the Security measure section, click a box to select a security measure.

To add another hardware item, click the Add hardware button again.

Impact assessment

1. In the Processing menu, click Impact assessment.

2. The Impact assessment page opens. You will receive the full completion percentage for this section if you answer:

• Yes to the first question

• Yes or Not applicable to the next question.

Any other combination of answers will not give you the full completion percentage.

Status and documentation

1. In the Processing menu, click Status and documentation.

2. The Status and documentation page opens. It allows you to:

• View the status of the processing activity

• Add documents (for more information, see Working with documents).

• View actions assigned to the processing activity

• Add comments