Task 1 — Identify Processing Activities

Ask every department one question: what do you do with personal data?

A processing activity is a business process that uses personal data for one purpose, such as payroll, recruitment or the newsletter. Short interviews with the process owners find them faster than any questionnaire.

How to find them

HR: recruitment, payroll, time recording, personnel files, training
Sales and marketing: customer management, newsletters, events, website and analytics
Finance: accounting, invoicing, debt collection
IT: user accounts, logging, e-mail, video surveillance and access control
Core business: the processes that are specific to your organisation
Rule of thumb: one entry per purpose. "HR" is too broad, "payroll" and "recruitment" are two activities.

Records requirement in your jurisdiction

Colombia

Companies with total assets above 100,000 UVT must register their databases in the National Database Registry (RNBD) of the SIC, with data categories, purposes, security measures and international transfers, and keep the registration up to date. The records of processing provide this information.

Example: result of a 30-minute interview with HR

Processing activity	Purpose in one sentence	Process owner
Recruitment	Select applicants for open positions	Head of HR
Payroll	Pay salaries and meet tax and social security obligations	Payroll officer
Time recording	Record working hours and absences	Head of HR
Personnel files	Manage the employment relationship	Head of HR
Training	Plan and document employee training	HR development

In ResGuard, create one entry per activity in the Data Inventory (RoPA) right after the interview; the details follow in the next tasks.