Since they may be inspected at any time by the CNIL, the French data protection authority, companies, public administrations and other associations must be able to prove their compliance in terms of personal data protection at any time. To this end, they are required to keep a record of their processing activities, which must be filled in very precisely and rigorously. The main objective of those who draw it up is therefore to comply with Article 30 of the General Data Protection Regulation (GDPR) of the European Parliament and of the Council, which clearly describes all the information that needs to be recorded in it.
Reminder: what is the record of processing activities?
The CNIL refers to a map of personal data processing. It is a document that lists in detail all the processing carried out on the personal data collected. Processing means any operation or set of operations performed on personal data, such as collection, recording, organisation, structuring, storage, alteration, retrieval, use, disclosure or even simple consultation of the data.
The record can be drawn up by different people: the controller directly responsible for the processing, the DPO (Data Protection Officer) if there is one, or the processor. This document is not intended to be made public. However, public sector bodies are required to provide it to anyone who requests it. Private organisations are not required to provide it, although they may decide to share it with those who request it.
Supervisory authorities such as the CNIL, for their part, are able to consult it without any difficulty whenever they wish, during a simple check of compliance with the regulation, or following a dispute, in particular one resulting from a data leak. Keeping this record meets the new accountability principle put forward by the GDPR.
How do you build a record?
Gather the available information
- Identify and meet the operational managers of the various departments likely to process personal data
- Analyse the website and identify the data collected in online forms
- Use the list of processing operations declared to the CNIL under the former obligations that applied to companies
- Refer to the various simplified standards drawn up by the CNIL
Draw up the list of processing activities
- List the different activities that require the processing of personal data
- Make use of the information gathered during the interviews
- Fill in one record sheet per purpose of personal data processing
Refine and clarify
- On the basis of this record, identify and analyse the risks that may affect the data processing operations in place
- Draw up a GDPR compliance action plan
- Update the record
The content of a record of processing activities
A properly completed record of processing activities is a guarantee of transparency and seriousness that can have a strong impact on brand image. The right information still has to be entered in it, though. To guide controllers in the task of drafting it, the CNIL offers a list of simple questions that serve as a common thread…
- who is the person responsible for the processing? Specify their name and contact details, as well as those of the representative, the DPO and the processors, if any.
- for what purpose is the personal data collected? State all the purposes very precisely (creating a staff file, a list of suppliers, etc.)
- what are the categories of people concerned by the processing (employees, customers, members, patients, etc.)? And what are the categories of data collected (names, contact details, ID photos, telephone numbers, CVs, payslips, number plates, consumption habits, IP addresses, etc.)?
Do not forget to specify sensitive data
- where will the data be located? What will its final destination be and who will manage it? List all the recipients
- are there any transfers outside the European Union? If so, specify the names of the recipients and their country of origin
- what will the data retention period be? Specify the time limit for erasure, which may differ from one category to another
- what security measures are planned to protect the data (preventing unauthorised access, limiting the risk of breaches, etc.)? Detail the various arrangements put in place, both technical and organisational
How often should the record be updated?
The record must be updated regularly in line with functional and technical changes to the data processing. In practice, this concerns any change made to the conditions under which each processing operation entered in the record is carried out:
- new data collected
- extension of the retention period
- new recipient of the processing, etc.
Are there any exceptions?
In principle, SMEs with fewer than 250 employees are not required to keep this type of record, except in certain cases:
- if the processing is routine (creating customer files, staff files, etc.) and not occasional.
- if the rights and freedoms of the people concerned by the processing are likely to be threatened (risk of discrimination, etc.).
- if the data collected is considered sensitive (medical, racial, political, religious or judicial information).
If at least one of the conditions described above is met, keeping a record of processing activities becomes mandatory, even for small organisations with fewer than 250 people.
Record not filled in: the possible penalties
In the event of a straightforward failure to keep the record, the CNIL may impose a financial penalty on the company that has not complied with this provision of the GDPR. The penalty can be as high as 2% of annual worldwide turnover. Alternatively, public formal notices may also be issued against offenders.
