Working with documents

This article provides a full description of how to handle documents in the GDPR software.

Table of contents

• Document management approach
• Working with the document database
• Linking documents
• Unlinking documents
• Sharing documents with subsidiaries

 

Documents play a central role in GDPR compliance. The GDPR software provides a comprehensive approach to document management, allowing you to easily add, categorize, link, unlink, delete and share documents.

Document management approach

The GDPR software comprises three interconnected levels for managing documents.

 

There are two basic ways to work with documents:

• use the document database (level 1)

• work via elements, e.g. processing activities (level 2), or documentable items (level 3).

The choice will mostly depend on your role in the entity, how your entity is organized, and your personal preferences.

This article describes both ways of working. Naturally you can switch easily and seamlessly between the two.

Working with the document database

The document database is the core of your documentation system. It’s where you’ll organize and store all the documents you need to support the information entered in the GDPR software. Documents can be added in the form of files, or via external links pointing to where the documents are located.

Once a file or external link is added, it can be linked to elements and documentable items.

To work with the document database:

1. In the sidebar, click Document database. The document database opens. The list of standard document categories is displayed.

2. To choose where a new document will be stored, select Legal documents or Technical / Organizational documents, and then click a category. If you wish to create a new category, click the Add new category field, enter the name of the category, and click the Add button.

3. Click the Add document link. A window opens.

4. You have two options:

• A) To add a document file, click the document area and select the file on your computer system, or drag the file into the box. The Document title field will be populated automatically with the file name. You can add a comment (optional).

• B) To add an external link, click External link. In the Link field, enter the name of the external link where the document is located. In the Document title field, enter the name of the document, and add a comment (optional).

5. Click the Add document button. The document is added to the database.

6. To locate a document, click its category, or use the Search document field. The document is listed to the right.

7. To perform additional actions, click the document. The Document window opens.

You can perform the following actions:

 

Linking documents

Documents can be linked to elements, or to documentable items within elements.

Linking a document to an element

An “element” is a generic terms that covers processing activities, software, third parties, actions, data breaches, impact assessments (PIA), and project forms. To show how to link a document to an element, we’ll use the example of a processing activity.

 

To link a document to a processing activity:

1. Open the processing activity and go to Status and documentation (see Creating Article 30-compliant processing).

2. Click the Add document link. A window opens.

3. Do one of the following:

• If you are adding a new document that is not yet in the document database, complete the New document fields (see To work with the document database above). You must select a category. Then click Add document.

• If you are adding a new external link that is not yet in the document database, click External link, and complete the fields see To work with the document database above). You must select a category. Then click Add document.

• If the document is already in the document database, click Document database. Locate the document by clicking the Folder field and/or enter the document title in the Search for document fields. Once the document is displayed, click the Attach button (if the attach button is grayed it means the document is already linked to the element).

4. The document appears in the list of documents linked to the element.

 

To link a document to another type of element:

The same basic approach used to link a document to a processing activity is followed for software, third parties, actions, data breaches, impact assessments, and projects. The following screenshots show where the Add document link is located in each type of element.

Linking a document to a documentable item

We saw above how to add a document to an element. In addition, in certain elements, you can add documents to specific items. They are called “documentable items”. Documentable items can be found in the Data Subject Rights section of a processing activity, and in the Content tab of software.

To show how to link a document to a documentable item, we’ll use the example of a Data subject rights item.

 

To link a document to a data subject rights item:

1. Open the processing activity, go to Data subject rights and select an item (see Completing processing in Extended mode).

2. Click the Add document link and follow the same steps as for linking a document to an element (see Linking a document to an element above).

3. The document is shown as linked to the item.

To link a document to another type of documentable item:

The basic approach is the same for other types of documentable items. A documentable item on a software page is shown below.

Unlinking documents

Documents can be unlinked from elements and documentable items.

Unlinking a document from an element

To explain how to unlink a document from an element, we’ll use the example of a processing activity.

 

To unlink a document from a processing activity:

1. Open the processing activity and go to Status and documentation (see Creating Article 30-compliant processing).

2. In the list of documents, click the “unlink” icon.

3. In the message window, click Unlink.

 

To unlink a document from another type of element:

The procedure followed for a processing activity is basically the same for software, third parties, actions, data breaches, impact assessments, and projects. To locate the “unlink” icon in each element, see the screenshots in To link a document to another type of element above.

Unlinking a document from a documentable item

When you unlink a document from a documentable item, you decide whether you want to unlink the document from just that item, or from the entire element. To explain, we’ll use the example of a Data subject rights item in a processing activity.

 

To unlink a document from a data subject rights item:

1. Open the processing activity and go to Data subject rights (see Completing processing in Extended mode).

2. Click the “unlink” icon of the document you want to unlink. A message window opens.

3. Do one of the following:

• Select Unlink from item to unlink the document from the documentable item only.

  

• Select Unlink from processing to unlink the document from the entire processing activity, i.e. the Status and documentation tab and any other documentable items. If the document is linked to other documentable items in the processing activity, a message will tell you how many.

4. Click the Unlink button.

 

To unlink a document from another type of documentable item:

The procedure is basically the same for other types of documentable items.

Sharing documents with subsidiaries

The features described in this section are designed to give parent companies full control over how they share documents with their subsidiaries. Basically, parent companies can:

• Disable or enable document sharing by default

• Override the default setting for individual documents

Default share setting

The default share setting allows a parent entity to determine whether or not it wishes to share its documents with its subsidiaries by default.

By default, the share setting is set to “share”. This means that when a document is added to a parent company, it will automatically and immediately appear in the document database of its subsidiaries, which can then link it to their own processing activities or other elements.

Overriding the default share setting

It is possible to override the default share setting for individual documents. For instance, as a general rule you may not wish to share documents with your subsidiaries, but there may be exceptions. Or you may wish to not share a document at the time it is added, but share it at a later time.

 

To override the default share setting:

1. In the sidebar, click Document database.

2. Locate the document by entering the document title in the Search document field, or click its category. The document appears to the right.

3. Click the document to open the Document window.

4. Click the Stop sharing with the subsidiaries or Share with the subsidiaries button (depends on the default sharing status).

 

5. A message is displayed, reminding you that subsidiaries may be using this document in their validated or archived processing activities. To confirm your choice, click Deactivate or Activate (depending on the current default sharing status).

Message displayed if sharing is currently enabled

Constraints for subsidiaries

For documents shared by parent companies, subsidiaries cannot:

• replace document files

• edit external links

• change document categories

• delete documents.

When a subsidiary entity opens a document page, the following message is displayed if the document was shared by a parent company: