Task 1 — Identify Processing Activities

Ask every department one question: what do you do with personal data?

A processing activity is a business process that uses personal data for one purpose, such as payroll, recruitment or the newsletter. Short interviews with the process owners find them faster than any questionnaire.

How to find them

HR: recruitment, payroll, time recording, personnel files, training
Sales and marketing: customer management, newsletters, events, website and analytics
Finance: accounting, invoicing, debt collection
IT: user accounts, logging, e-mail, video surveillance and access control
Core business: the processes that are specific to your organisation
Rule of thumb: one entry per purpose. "HR" is too broad, "payroll" and "recruitment" are two activities.

Records requirement in your jurisdiction

Mexico

The LFPDPPP does not require a GDPR-style record, but the security measures include an inventory of personal data and processing systems, and the privacy notice and ARCO procedures rely on knowing every processing activity.

Example: result of a 30-minute interview with HR

Processing activity	Purpose in one sentence	Process owner
Recruitment	Select applicants for open positions	Head of HR
Payroll	Pay salaries and meet tax and social security obligations	Payroll officer
Time recording	Record working hours and absences	Head of HR
Personnel files	Manage the employment relationship	Head of HR
Training	Plan and document employee training	HR development

In ResGuard, create one entry per activity in the Data Inventory (RoPA) right after the interview; the details follow in the next tasks.