Record of Data Collection and Processing Activities

This is our Record of Data Collection and Processing Activities template. This is the document you require under Article 30. It is because of the change in the law on what constitutes personal data. This means every organisation holding any personal data will now be required to:

• register with the ICO as a handler of data, and
• also have a record of its data processing activities.

It is intended to be used as an internal document by you and can be used as a checklist of what you do in terms the processing of data. You should also use to analyse your data processing activities – it then feeds into how you draft your Privacy Policy and Staff and Contractor Data Privacy Notice.

Our record is GDPR-compliant and helps you to get fully compliant. You will find it very easy to use.

Other GDPR compliance documents

If you need other GDPR compliance documents as well as the record of data collection and processing, then please have a look at:

• the full range of individual templates here, and
• also our full GDPR compliance kit here with 33% off.

Data protection registration with the ICO

If you handle personal data but have not yet registered with the ICO, then please register here: https://ico.org.uk/registration/new/about. This link will get you started right away on registering. If you prefer to carry out a pre-assessment first, to decide whether you need to register, then you  can find it here: https://ico.org.uk/for-organisations/register/self-assessment/. The way the pre-assessment questionnaire is set up for GDPR, means nearly everyone doing the assessment will get the answer that they need to register. A failure to register is:

• already a breach of the earlier law from 1998, and
• will make any prosecution/investigation for any other data protection compliant or investigation so much worse for you.

So we urge you to take the necessary action.

Guide to Record of Data Collection and Processing Activities

What follows is an excerpt from our guide to this template. The full guide comes with the template.

We have designed this document to ensure compliance with the requirements of Article 30 of GDPR. Article 30 requires that a business documents:

• the nature of the personal data that it collects and
• how you process that data.

Our record template helps you to fulfil with that GDPR requirement. We have designed this template in a way that will require you to think about what data you collect across all of the key categories of data subjects (the individuals whose data you collect).

Also the guide to the record of data collection and processing contains explanatory sections within it that walk you through completing the document.

Once you have completed the document, then you can use the information that you have collected to assist you in completing:

• your external Privacy Policy and Notice and
• your internal Staff and Contractor Data Privacy Notice.