Where it stands

Who keeps this record

Set once: the name and contact details of the controller or processor, and of any representative and data protection officer.

Kept as

Organisation

Address

Telephone

Representative, where one is needed

Representative's contact details

Data protection officer, where one is appointed

DPO's contact details

Add a processing activity

One entry per activity. Leave a field empty rather than guess: the completeness check names it.

Activity

Owner

Purpose of the processing

Lawful basis

Categories of data subjects

Categories of personal data

Includes special category data Includes criminal offence data

Categories of recipients

Transferred outside the UK and EEA

Retention period, by the name it has in RETENTION if it is there

Source of the data

Data protection impact assessment

Touched by an incident

Last reviewed

Reviewed next

Technical and organisational security measures

Anything worth knowing

The register

Basis

Special category

Transfer

Completeness

Every field Article 30 asks for that is still empty, then the ones the ICO recommends alongside it.

Getting it out

Doing this often? The OBSCURA Sovereign Suite keeps the record of processing with the policies, risks and evidence it relies on. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.

Keep the record of processing Article 30 asks for ROPA