Recording your data processing activities

What are "data processing activities"?

Your data processing activities are quite simply the activities carried out across your business that uses personal data. These activities should serve a specific purpose necessary to operate your business know as your "purposes for processing". Here are a few examples of "purposes for processing" you might find in HR: 

"Q. What is the purpose for processing?"

  • Payroll, pension or other benefits processing
  • Statutory and contractual leave administration
  • Performance review and disputes management
  • Human resources process management
  • Health, safety and wellbeing fulfilment
  • Training and development
  • Contractual roles fulfilment
  • Background checks processing

TOP TIP - notice these purposes are specific but not completely granular. It's important to get this balance right when recording your purposes for processing to ensure a manageable process as well as offering a wider scope for operations in your policies.

Recording your processing activities

To build a complete picture of your data processing activities we need to document all the processes in your business that use personal data and legitimate purposes for why. These "purposes for processing" will form the foundations of your documentation so its important to be thorough here.

Data processing activities are added per business function, meaning you will only be asked to record data activities for functions assigned to you. These functions are as follows:

  • HR
  • Marketing
  • Customer Service
  • Sales
  • Finance
  • IT
  • Operations

Business functions that don't apply to you can be skipped by selecting "we have no [Business function} processing activities".

To add a data activity click create, assign the purpose for processing and answer the questions that follow. Repeat the process until all of your data activities have been recorded, you may have quite a few. 

You should aim to cover all the legitimate reasons your business needs to process personal data without being so granular that the process becomes unmanageable. 

TOP TIP - PORT offers you a list of common purposes for processing tas examples to get you off on the right foot, but you may find you need to add some of you own - no problem, just type your custom field in the selection box. 

Creating custom purposes for processing 

When adding your own custom purpose for processing, you should look to summarise a group of activities based around their purpose.

For example in Operations, to fulfil the role of delivering your product or services to your client, your business may need to carry a whole range of granular activities such as: 

  • processing the order
  • preparing their order
  • packaging their order
  • delivering their order
  • making sure their order has been delivered

But recording your activities to this level of granularity is unnecessary and impractical to keep up to date. Instead, you should think about your activities based on their purposes and record them as such. 

Take the same example again:

"processing the order, preparing their order, packaging their order, delivering their order, making sure their order has been delivered"

These can all be summed up and expressed as the purpose:

  • To deliver our product and services"

You should look to take this approach when documenting your data activities, so as to be clear about the purpose for which you are processing data without being so granular as to break down each step of the processes unnecessarily. 

 

Helpful Links