Neat and Tidy GDPR Documentation Could Save You £8 Million

The General Data Protection Regulation (GDPR) is nearly upon us and—regrettably—many organisations are still unprepared.

In fact, 55 per cent of organisations still don’t have a structured plan to ensure compliance, according to a recent survey from software suite developer, SAS. Regardless of where your organisation is in the process, it is essential that you don’t overlook the documentation of your processing activities. Because, if you’re disorganised in your efforts, you can be fined up to roughly £8 million or 2 per cent of your annual turnover, whichever may be higher.

To ensure that your organisation’s documentation process is neat, tidy and thorough, it must include the following information:

The name and contact details of your organisation
The purposes of your processing
A description of the categories of personal data
The categories of recipients of the personal data
Details of your transfers to third countries, including documenting the transfer mechanism safeguards in place
Retention schedules
A description of your technical and organisational security measures

As a best practice, the Information Commissioner’s Office (ICO) also recommends you record the following:

Information required for your privacy notices, such as the lawful basis and the legitimate interests for the processing
Records of consent
Controller-processor contracts
The location of personal data
Data protection impact assessment reports
Records of personal data breaches

Your organisation must document all processing activities if you have at least 250 employees. Otherwise, you only need to provide information about your document processing activities that are not occasional, that could result in a risk to the rights and freedoms of individuals, or that are involved the processing of special categories of data.

Nevertheless, regardless of the size of your organisation, you should take the following steps to prepare your documentation: