Keeping the processing register

The register describes each processing of personal data in your organisation: why the data is processed, on what legal basis, about whom, who receives it, how long it is kept and how it is protected. It is the first document a supervisory authority asks for (Article 30 of the GDPR).

It covers all your processing activities, not only those of MyZapp: payroll, video surveillance or business software belong in it too.

Who does what

Administrators have the same rights as officers.

Creating the legal entity

Each entity keeps its own register: an instance can hold several (group of companies, establishments).

1. Open Data protection › Processing register, then Legal entities.
2. Enter the code, company name and country.
3. Enter the data protection officer and, for a controller established outside the Union, its representative (Article 27).
4. Save.

These details appear at the top of the exported register.

Starting from the modules' proposals

The modules of MyZapp declare the personal data they hold, so you do not have to describe these activities from scratch.

1. In the register, click Propose the modules' processing activities.
2. Each activity not yet present arrives as Proposed, with its purposes, categories of data subjects and data, and proposed legal basis.
3. Open each proposal and complete it: the proposed legal basis is only a starting point, and it is up to you to confirm it.
4. Click Validate to enter it in the register, or Dismiss with a reason if the processing does not concern you.

A dismissed proposal is not proposed again: its reason stays in the register. You will find it in the Dismissed and archived tab, where you can restore it.

Adding a processing activity outside the application

Click New activity, then choose In another system under Where the data lives. Enter the system, its vendor, its hosting and its internal owner.

Also state how to exercise people's rights in that system: the system owner uses these instructions when a request arrives.

What the form checks

Saving is refused, with the reason, in these cases:

• no purpose is given;
• special categories of data (Article 9) are ticked without an Article 9(2) condition;
• criminal data (Article 10) is ticked without its basis;
• a transfer outside the Union is declared without the countries and the safeguard;
• an activity in the processor's register does not state the controllers on whose behalf it is carried out;
• an external system has no name.

The two registers

• Controller (Article 30(1)): the processing your organisation decides on.
• Processor (Article 30(2)): the processing you carry out on behalf of your customers.

Each has its own tab and its own exports.

Versions and reviews

Each change creates a dated version, with its author and the changed fields. The history is at the bottom of the form.

To plan a review, fill in Review every (months). When it falls due, the officers receive a reminder, and the Review due box in the register filters the activities concerned. Once the review is done, click Review done: the next due date is recalculated.

Exporting and importing

• PDF: the register in force, in your language, to present during an inspection.
• CSV: proposals and activities in force, with stable columns and codes whatever the language.
• Import a CSV: an unknown reference creates an activity, a known reference updates it. Invalid rows are refused and the others go through. The file must contain at least the reference and name columns; start from an export to get all the columns. A column missing from the file keeps the value of the existing activity.