Every data controller must keep records of the personal data they hold and the processing activities going on in their organization. However, Controllers with more than 250 employees must always keep a formal RoPA.
Data regulations, like GDPR, obliges organizations to record every action of the personal data after it is gathered and stored in the organizations’ computer systems. As it is stated in Article 30 of GDPR, organizations must have an inventory of the data processing and an overview of how the organizations use the personal data.
The reason behind this obligation is to be able to provide the information about personal data journeys and how it is used to the individuals and official agencies upon request.
Given the complicated nature of the data journey creating reports covering all the processes and making them available when demanded is not an easy task. It may be even more complicated when the obligations are not only imposed to the data controller but also to the processor.
GovenID’s data orchestration tool GID-O has a dedicated module for RoPA procesees. Our RoPA module would remarkably contribute to the organizations’ efforts to create RoPA reports by enabling them to collect required data easily. In addition to this, with GID-O’s RoPA module, conducting privacy impact assessments is not a mind-blowing task any longer.
GDPR “General Data Protection Regulation 2016”
“Each controller will have the responsibility to maintain records of all the processing activities which take place within the organization. These records (which need to be in writing, as well as in electronic form) must contain all of the following information:
(a) the name and contact details of the controller and where applicable, the data protection office;
(b) the purposes of the processing;
(c) a description of the categories of data subjects and of the categories of personal data;
(d) the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organizations;
(e) the transfers of personal data to a third country or an international organization, including the documentation of suitable safeguards;
(f) the envisaged time limits for erasure of the different categories of data; and
(g) a general description of the applied technical and organizational security measures.
(Art. 30 GDPR Records of processing activities)
Note 1: Please note that the obligation does not apply to organizations employing fewer than 250 individuals unless the processing involves a high risk, including the processing of special categories of personal data such as ethnic or health information or data on criminal behavior. If a data controller or a data processor, matching with this criteria does not maintain records of processing activities and/or does not provide a complete index to authorities, they are subject to fines according to Art. 83(4)(a) of the GDPR. The possible fines can be up to 10 million euros or 2% of their annual turnover.
In order to meet the ever-evolving privacy standards, it is no longer sufficient to merely comply with legislation and amendments. You’re only a mouse click away from working with our GovernID partners to develop a comprehensive privacy strategy tailored to your company’s unique goals and objectives. BEGIN RIGHT NOW
