Käsiteltävien henkilötietojen tunnistaminen

Processing of personal data is only lawful if one of the legal bases set out in the General Data Protection Regulation is met. The organization must be able to communicate the purpose of the processing and the legal basis to the data subject and, where appropriate, to the supervisory authority.

The documentation shall include at least:

• the legal basis for the processing and the necessary additional information
• the parties to whom the processing has been outsourced
• related data sets

Records of processing activities is a written description of the processing of personal data by the organization.

This report is mandatory if any of the following occurs:

• the organization has more than 250 employees
• the processing of personal data is not incidental
• the processing of personal data is likely to pose a risk to the data subject's rights and freedoms
• the personal data processed contain special categories of data or personal data relating to criminal convictions and offenses

Records must be kept up to date. They also serve as a first-level way of assessing the lawfulness of processing, so it must be provided to the supervisory authority on request.

In Cyberday, records of processing activities is an own report, which is automatically gathered from the data on documentation sections.

Organisation must maintain a listing of controlled data stores and their owners. Owner is responsible for completing the documentation and other possible security actions directly related to the data store.

Data store documentation must include at least:

• Connected responsibilities
• Data processing purposes (covered in a separate task)
• Data sets included in the data store (covered in a separate task)
• Data disclosures (covered in a separate task)
• When necessary, data stores connections to action processes