How detailed should my record of processing activities be?

As a rule of thumb, the more complex your organisation is, the more granular your mapping needs to be.

Here is an example of a processing activity found in most organisations:

In larger and more complex organisations, e.g. public institutions, processes will often vary between sectors/departments. The documentation needs to reflect these variations.

An example: Recruitment will in some instances need to be split up into two different processing activities because it is done in two different ways, depending on whether you are hiring for management or regular staff - or because the recruitment process looks different in the Frankfurt office than in the Berlin office.

Apart from the universal processing activities found in all organisations, you also need to include any activities particular to your field. Examples of field specific processing activities are reimbursements (insurance companies), registration of absences (primary schools) and prescription of medications (doctors).

Your record of processing activities needs to offer complete transparency of all your processes involving personal data and reflect all variations throughout the organization.

Questions? Write to us at support@wiredrelations.com