When you start to create the record of processing activities (RPA), the question of „how“ arises for most people from the very first task, the definition of processing activities. In this article, we explain in simple terms what a processing activity is and how you can find out which processing activities exist in your company.
A processing activity is a self-contained one-off or recurring activity in which personal data is processed manually or automatically. The GDPR requires that a company must know in which processes personal data is processed. This information and the associated details are the basis for information obligations (privacy policy) towards the data subject. In the case of services where you process personal data for another company, these processing activities are also part of the processor agreement.
To start with, the processes in which personal data is processed must be defined. The best way to do this is to go through your business processes and your value chain and create a VVT entry for each self-contained area where personal data is processed. Important: very often the mistake is made of using tool names as entries for the VVT, e.g. „Outlook Mails“ or „Customer data in Excel“. Avoid „tool-centered“ names and use names such as „Customer communication“ or „Customer data management“ instead. The tools are then a module in the VVT entry. Another tip: If you offer services (e.g. employee coaching), this service offer would be a separate VVT entry. If the service varies greatly from customer to customer, it makes sense to create a separate VVT entry for each customer (e.g. „Individual employee coaching customer X“).
As an alternative or as a supplement to the method described above by defining the business processes and the value chain, you can also try to identify relevant processing activities via the data flow. In doing so, you try to trace the „path“ of the data in the company. Where is data collected from customers and employees, where is it needed (processed) and stored, and when is it no longer needed? Using this overview, you can map the data flow in completed processing steps and thus entries in the VVT and at the same time already have content for the VVT entries. Here is an example using an online store, where the numbered headings represent the VVT entries:
Customer registration
Order process
Payment processing
Website use
E-mail marketing
If you have employees, you can proceed in a similar way. Processing activities such as the application process, employee onboarding, personnel administration, payroll accounting, etc. can then arise here.
Defining processing activities in a record of processing activities can be more difficult than you think. With the right systematic approach, many mistakes can be avoided and a good quality directory can be created, which later provides great added value when generating data protection guidelines or data processing agreements.
Further contributions
Defining the purpose and legal basis of data processing
If you collect and process personal data, there should be a purpose and a legal basis for doing so. Determining the legal basis in particular is not an easy task for most people. In this article, we explain how to define the right purpose and the right legal basis as part of the record of processing activities.
Controller or processor? The difference explained simply!
Controller and processor are two terms that raise a question mark for many people. In the following blog post, we briefly explain what the difference is and explain how you can easily determine which of the two roles you take on in which situation.
Very few companies think of the register of processing activities (VVT) when they think about data protection. What few people know: The VVT is probably the most important component in the GDPR jungle. In the following blog post, we explain why this is the case and how you can easily and comprehensibly start creating a DPIA yourself.
Start now and test with Metasoul how easy it is to fulfill data privacy compliance obligations.
made in Austria 🇦🇹
GDPR compliant ✅
EU AI Act compliant 🇪🇺
NIS2 compliant 🌐
Secure by design 🔒
