Difference between revisions of "Processing Activities"

From Privacy-Now
Jump to: navigation, search
(Created page with " == Introduction to Processing Records == ''Access Requests'' provide the mean for data subjects to exercise their right to access information about the processing of their '...")
 
(→‎Introduction to Processing Activities)
 
(31 intermediate revisions by 3 users not shown)
Line 1: Line 1:
  
−
== Introduction to Processing Records ==
+
== Introduction to Processing Activities ==
−
''Access Requests'' provide the mean for data subjects to exercise their right to access information about the processing of their
+
''Processing activities'' are the core element of ''personal data'' management. Many regulations require them to be documented and assessed.  
−
''personal data'' (e.g. according to section 2, article 13 of ''GDPR Regulation'').
 
  
−
The process enables to record "Access Requests" and to support their fulfilment.
+
Privacy-Now® dedicated process enables to record ''processing activities'', to maintain them and to use them for assessment or other tasks related to ''personal data'' management.
  
 
== Workflow ==
 
== Workflow ==
−
A new ''Access Request'' can be created using the ''Add New'' functionality and choosing "Access Request".
+
A new ''processing activity'' can be created using the ''Add New'' functionality and choosing "New Processing Activity".
  
−
A workflow enables to move the ''Access Request" in several statuses as shown in the following picture.
+
A workflow enables to move the ''processing activities'' in several statuses as shown in the following picture.
  
−
[[File:Access Requests Workflow ENG v1.0.JPG|centre|thumb|800x800px|Access Requests workflow and statuses.]]
+
[[File:Processing Activities Workflow ENG v1.0.JPG|centre|thumb|800x800px|Processing activities workflow and statuses.]]
  
  
Line 19: Line 18:
 
! Status !! Description
 
! Status !! Description
 
|-
 
|-
−
|Default || A transitory status active when the ''access request'' if initially created.  
+
|Default || A temporary status when the ''processing activity'' is initially created before the first save.  
 
|-
 
|-
−
|Opened || An ''access request'' in this status is draft and it is not actioned.
+
|Draft || A ''processing activity'' in this status is draft.
 
|-
 
|-
−
|Requested || An ''access request'' in this status is confirmed and it is waiting to be actioned.
+
|Active || A ''processing activity'' in this status is actually executed by the ''organization''.
 
|-
 
|-
−
|In charge || In this status, the ''access request'' has been taken in charge and it is being actioned.  
+
|Inactive || A ''processing activity'' in this status is not executed by the ''organization''. Either it was in the past or it will in the future.  
 
|-
 
|-
−
|Cancelled || ''Access request'' cancelled. This is an end of life status.
+
|Cancelled || ''Processing activity'' cancelled. It is still possible to recover a ''processing activity'' from this status by enabled ''users''.
−
|-
 
−
|Completed || In this status, all activities related to the ''action request'' were completed and closure is expected after confirmation.
 
−
|-
 
−
|Suspended || Activities concerning the ''access request'' are temporarily suspended, meaning no further status transitions are allowed.
 
−
|-
 
−
|Closed || In this status, all activities related to the ''access request'' are completed and confirmed. This is an end of life status, meaning no further status transitions are allowed.
 
 
|-
 
|-
 
|}
 
|}
  
 
== Information ==
 
== Information ==
−
''Access request'' records information are organized in four secions:
+
''Processing activities'' records are organized in four sections:
  
−
* <u>''Identification''</u>, where identification data of the ''access request'' are recorded,
+
* <u>''Identification''</u>, where identification data of the ''processing activity'' are recorded,
−
* <u>''Ownership & Organization''</u>, containing the assignment of the key roles enabled to manage the ''access request'';
+
* <u>''Ownership & Organization''</u>, containing the assignment of the key roles enabled to manage the ''processing activity'';
−
* <u>''Access Request Details''</u>, with the details of the ''access request'';
+
* <u>''Characteristics''</u>, with the key attributes of the ''processing activity'';
−
* <u>''Data Subject Details''</u>, with the details of the ''data subject'' issuing the ''access request'';
+
* <u>''Information Technology''</u>, with information about the technologies used to process ''personal data'' by the ''processing activivty''.
−
* <u>''Data Subject Representative''</u>, containing the details of the representative of the ''data subject'', if any.
 
  
−
Details on every fiel can be found by pointing the mouse on the (i) next to each field. This will activate a tooltip with a brief description of the field.
+
Detailed information on the meaning and use of every field can be found by pointing the mouse on the (i) next to each field. This will activate a tooltip with a brief description of the field.
  
−
TBC WITH TAB INFORMATION...
+
Additional information can be found in the secondary forms of the record: attachments, related items, messages and history. See [[How To]] for more information.
  
 
== Privileges ==
 
== Privileges ==
−
''Access request'' can be created by the users to whom the corresponding privilege is granted (see [[Users & Groups]] for more information on how to set this privilege.
+
''Processing activities'' can be created by the ''users'' to whom the corresponding privilege is granted (see [[Users & Groups]] for more information on how to set this privilege).
  
−
The lifecycle of the ''access request'' is managed by the roles ''DPO group'', ''data controller group'', ''data processor group'' and ''owner''. ''Groups'' are pre assigned to the roles according to the settings (see [[Settings]] for more information on how to set these defaults). Initial assignments can be modified according to privileges choosing among the enabled ''groups'' (see once again [[Settings]] for more information on how to enable ''groups'')
+
The lifecycle of the ''processing activity'' is managed by the roles described in the table below. ''Groups'' are pre assigned to the roles according to the ''settings'' (see [[Settings]] for more information on how to set these defaults). Initial assignments can be modified according to privileges choosing among the enabled ''groups'' (see once again [[Settings]] for more information on how to enable ''groups'').
  
 
{| class="wikitable"
 
{| class="wikitable"
 
! Role !! Description
 
! Role !! Description
 
|-
 
|-
−
|<u>DPO Group</u> || Members of the ''group'' assigned to this role maximum privileges on ''access requests''. They can:
+
|<u>DPO Group</u> || Members of the ''group'' assigned to this role have full privileges. They can:
−
* transition ''access requests'' to any compatible status,
+
* transition records to any compatible status,
−
* update ''access requests'' fields when possible,
+
* update fields when possible,
−
* update ''access request'' ''data sources'' directly in record management.
+
* update ''data sources'' directly in record management,
−
|-
+
* revert from "Cancelled" status.
−
|<u>Data Controller Group</u> || Members of the ''group'' assigned to this role have mainly view privileges on ''access requests''.
 
 
|-
 
|-
−
|<u>Data Processor Group</u> || Members of the ''group'' assigned to this role have mainly view privileges on ''access requests''.
+
|<u>Data Controller Group</u> || Members of the ''group'' assigned to this role have view (read) privileges.
 
|-
 
|-
−
|<u>Working Team</u> || Members of this ''group'' have many privileges on the ''access request''. They can manage its entire lifecycle, being enabled to:
+
|<u>Data Processor Group</u> || Members of the ''group'' assigned to this role have view (read) privileges.
−
* transition ''access requests'' to any compatible status,
 
−
* update ''access requests'' fields when possible.
 
 
|-
 
|-
−
|<u>Audit Team</u> || Members of the ''group'' assigned to this role have mainly view privileges on ''access requests''.
+
|<u>Auditors Team</u> || Members of the ''group'' assigned to this role have view (read) privileges.
 
|-
 
|-
−
|<u>Owner</u> || This role can be assigned to a single user among members of the ''groups'' previously assigned. The <u>Owner</u> has many privileges on the owned ''access requests'':
+
|<u>DPA Owner</u> || This role can be assigned to a single user among members of the ''DPO group'' or the ''Data Controller Group''. The <u>DPA Owner</u> has several privileges:
−
* transition ''access requests'' to any compatible status,
+
* transition to any compatible status,
−
* update ''access requests'' fields when possible.
+
* update fields when possible.
 
|}
 
|}
  
−
== Warning and alerts ==
+
== Reports ==
−
TBC
+
The list of ''processing activities'' can be filtered and exported to excel format from the ''view'' '''''Processing Activities'''''.
  
−
== Reports ==
+
Finally, it is possible to print the ''processing activity'' card using the '''Print''' command positioned up right in the ''<u>General</u>'' form of the ''processing activity'' record.
−
The list of ''access requests'' can be filtered and exported to excel format from the ''view'' '''''Access Requests'''''.
 
  
 
== Related processes ==
 
== Related processes ==
−
''Access Requests'' can be related to ''processing activities''
+
Many other entities can be related to ''processing activity'' records, in particular:
 +
* ''access requests'',
 +
* ''actions'',
 +
* ''impact assessments'',
 +
* ''risks''.

Latest revision as of 11:03, 31 October 2019

Introduction to Processing Activities

Processing activities are the core element of personal data management. Many regulations require them to be documented and assessed.

Privacy-Now® dedicated process enables to record processing activities, to maintain them and to use them for assessment or other tasks related to personal data management.

Workflow

A new processing activity can be created using the Add New functionality and choosing "New Processing Activity".

A workflow enables to move the processing activities in several statuses as shown in the following picture.

Processing activities workflow and statuses.


The following table explains the meaning of each status:

Status Description
Default A temporary status when the processing activity is initially created before the first save.
Draft A processing activity in this status is draft.
Active A processing activity in this status is actually executed by the organization.
Inactive A processing activity in this status is not executed by the organization. Either it was in the past or it will in the future.
Cancelled Processing activity cancelled. It is still possible to recover a processing activity from this status by enabled users.

Information

Processing activities records are organized in four sections:

  • Identification, where identification data of the processing activity are recorded,
  • Ownership & Organization, containing the assignment of the key roles enabled to manage the processing activity;
  • Characteristics, with the key attributes of the processing activity;
  • Information Technology, with information about the technologies used to process personal data by the processing activivty.

Detailed information on the meaning and use of every field can be found by pointing the mouse on the (i) next to each field. This will activate a tooltip with a brief description of the field.

Additional information can be found in the secondary forms of the record: attachments, related items, messages and history. See How To for more information.

Privileges

Processing activities can be created by the users to whom the corresponding privilege is granted (see Users & Groups for more information on how to set this privilege).

The lifecycle of the processing activity is managed by the roles described in the table below. Groups are pre assigned to the roles according to the settings (see Settings for more information on how to set these defaults). Initial assignments can be modified according to privileges choosing among the enabled groups (see once again Settings for more information on how to enable groups).

Role Description
DPO Group Members of the group assigned to this role have full privileges. They can:
  • transition records to any compatible status,
  • update fields when possible,
  • update data sources directly in record management,
  • revert from "Cancelled" status.
Data Controller Group Members of the group assigned to this role have view (read) privileges.
Data Processor Group Members of the group assigned to this role have view (read) privileges.
Auditors Team Members of the group assigned to this role have view (read) privileges.
DPA Owner This role can be assigned to a single user among members of the DPO group or the Data Controller Group. The DPA Owner has several privileges:
  • transition to any compatible status,
  • update fields when possible.

Reports

The list of processing activities can be filtered and exported to excel format from the view Processing Activities.

Finally, it is possible to print the processing activity card using the Print command positioned up right in the General form of the processing activity record.

Related processes

Many other entities can be related to processing activity records, in particular:

  • access requests,
  • actions,
  • impact assessments,
  • risks.
Retrieved from "http://wiki.privacy-now.eu/en/index.php?title=Processing_Activities&oldid=790"