Page 1

Reporting
athe
violation
File
aSecurity
complaint
personalto
data
protection
Personal
Data Office
Inspector's
applicationData
Contact
with theUODO
inspector
Data
Protection
Personal
(DPO)
Protection

Enter the phrase you are looking for

Applications,
conclusions,
Applications,
conclusions,
petitions - general
petitions
letter
- general
letter
from
natural
persons
Contact
with
Request
theinformation
team
for sharing
Press (for
public
media)

Office helpline 606-950-000

President and Office

Complaints

Data Protection Officer

Administrator

Right

Education

Cooperation

Tutorials

contact

» The most important topics » GDPR in practice

Recording of processing activities
A guide by the President of the Personal Data Protection Office
The General Data Protection Regulation (GDPR) provides that data controllers and processors have an obligation

Codes and certification

keeping a register of activities or a register of categories of activities, respectively. Art. 30 GDPR indicates their obligatory components, however
this provision may raise doubts as to the meaning of individual terms used in its content and the manner of fulfilling this obligation.

DPO-related forms

In order to facilitate the implementation of this task, the President of the Office for Personal Data Protection (the President of the Personal Data Protection Office) prepared registry templates
processing activities and the register of activity categories with examples of their supplementation and explanations on the manner of implementation

Other forms

this obligation.
The presented register templates should not be considered the only correct templates. Due to the variety
controllers, the sectors in which they operate and the data processing processes that they carry out, and other factors in practice can
there are many different models (structures) of the activity register. It is important that in any case the controller or processor
was able to present the required in Art. 30 sec. 1 and 2 GDPR elements in relation to all conducted processes
processing of personal data in a legible and transparent manner.
The position of the Art. 29 Group
On May 14, 2018, the Article 29 Working Party (now the European Data Protection Board - EDPB) adopted a position that indicates when
entrepreneurs employing less than 250 people will not be exempt from the obligation to keep a register of processing activities.
Due to numerous questions from entrepreneurs to national supervisory authorities, the Art
EU ombudsmen for the protection of personal data, including the President of the Personal Data Protection Office (formerly GIODO), adopted a position in which it indicates in which
In cases, controllers or processors with fewer than 250 employees must keep a record of the activities
processing.
This obligation must be fulfilled when the processing:
may cause a risk of violation of the rights or freedoms of data subjects,
is not occasional,
includes special categories of personal data referred to in art. 9 sec. 1, or personal data concerning judgments
criminal convictions and offenses.
At the same time, for its creation it is enough that any of these situations occurs independently.
However, the register of processing activities must be kept only for those indicated types of processing.
As an example, the Article 29 Working Party cites the case of a small organization most likely to process data systematically
about their employees. As he points out, 'as a consequence, such processing cannot be considered' occasional 'and must therefore
with this be included in the register of processing activities. However, other processing activities that are in fact
'Occasional' need not be included in the record of processing activities, provided that they are unlikely to be causing it
the risk of violating the rights or freedoms of natural persons, and do not include special categories of data or personal data concerning
convictions and prohibited acts ”.
2018-05-22

Attached files
Notes and explanations regarding the obligation under Art. 30 sec. 1 and 2 of the GDPR
Records of processing activities (examples for school)
Register of categories of processing activities

President and Office

UODO hotline

Office for Personal Data Protection

News

606-950-000

ul. Stawki 2, 00-193 Warsaw

Right

open on business days from 10: 00-14: 00

kancelaria@uodo.gov.pl

Education

Working hours: 8.00-16.00

Schengen
Cooperation
Public procurement
Archive giodo.gov.pl
© UODO 2018 - 2021 All rights reserved.

Privacy Policy | Home | Contact | Fortress

