Task 1 — Identify Processing Activities

Ask every department one question: what do you do with personal data?

A processing activity is a business process that uses personal data for one purpose, such as payroll, recruitment or the newsletter. Short interviews with the process owners find them faster than any questionnaire.

How to find them

HR: recruitment, payroll, time recording, personnel files, training
Sales and marketing: customer management, newsletters, events, website and analytics
Finance: accounting, invoicing, debt collection
IT: user accounts, logging, e-mail, video surveillance and access control
Core business: the processes that are specific to your organisation
Rule of thumb: one entry per purpose. "HR" is too broad, "payroll" and "recruitment" are two activities.

Records requirement in your jurisdiction

Malta

Controllers and processors must keep records of processing activities (Art. 30 GDPR) and provide them to the supervisory authority on request. The exemption for organisations with fewer than 250 employees does not apply if the processing is not occasional, involves special categories or is likely to result in a risk, so in practice almost every organisation needs one.

Example: result of a 30-minute interview with HR

Processing activity	Purpose in one sentence	Process owner
Recruitment	Select applicants for open positions	Head of HR
Payroll	Pay salaries and meet tax and social security obligations	Payroll officer
Time recording	Record working hours and absences	Head of HR
Personnel files	Manage the employment relationship	Head of HR
Training	Plan and document employee training	HR development

In ResGuard, create one entry per activity in the Data Inventory (RoPA) right after the interview; the details follow in the next tasks.