Records of Processing Activities
ISMS
Records of Processing Activities
The record of processing activities contains the processing operations within your organisation. You link each processing operation to the relevant information systems and infrastructure, even when these are managed by an external party.
This is what the overview looks like
All processing operations in a single list, with an immediate view of the business process, involved systems, owner, and completeness.
What do you record for each processing operation?
Fields marked with an * are mandatory.
Basic details
- Processing name *
- Business process *
- Purpose of processing *
- Complete (yes/no)
Involved parties
- Data controller(s)
- Processor
- Recipients
Responsible parties
- Owner *
- Action holders
Systems
- Involved information systems
- Service start date
Legal & risk
- Legal basis
- PIA (yes/no)
- Urgency
Security & evaluation
- Security measures
- Evaluation date
- Person responsible for evaluation
Linked to other features
The record of processing activities is central and constantly refers to what you have already recorded elsewhere in the system.
Data controller, processor & recipients
These parties are drawn directly from the relationship types you define in Relationship Management.
Owner & action holders
The owner and action holders (such as the process owner) are contacts managed within Contact Management.
Involved information systems
Systems such as Outlook365 or Exact are linked to the processing operation and managed centrally in Asset Management.
PIA
If you indicate that a PIA is required for a processing operation, you can perform it via DPIAs within Risk Management.
Questions about records of processing activities?
Please feel free to contact us.