Data Protection Workshop 3

Records of Processing Activities

Build the central inventory of how your organisation processes personal data
One slide per task, each with an explanation and a practical example
The basis for almost every following workshop: notices, retention, requests, risks and vendors

Europe

Latin America

Peru Colombia Mexico Chile

Asia-Pacific

Singapore Malaysia

Jurisdiction selected: Colombia — Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015)

After this workshop you have

The processing activities of all departments recorded in ResGuard
Data, data subjects, recipients and systems documented for each activity
A specific purpose and legal basis for every activity, and documented consent processes
Retention periods, transfers, owners and a review cycle in place

Agenda — one slide per task

1. Identify processing activities
2. Data categories, data subjects and data flows
3. Purposes and legal basis
4. Consent management
5. Retention periods and transfers
6. RoPA review and maintenance
7. Workshop review and close-out

Task 1 — Identify Processing Activities

Ask every department one question: what do you do with personal data?

A processing activity is a business process that uses personal data for one purpose, such as payroll, recruitment or the newsletter. Short interviews with the process owners find them faster than any questionnaire.

How to find them

HR: recruitment, payroll, time recording, personnel files, training
Sales and marketing: customer management, newsletters, events, website and analytics
Finance: accounting, invoicing, debt collection
IT: user accounts, logging, e-mail, video surveillance and access control
Core business: the processes that are specific to your organisation
Rule of thumb: one entry per purpose. "HR" is too broad, "payroll" and "recruitment" are two activities.

Records requirement in your jurisdiction

Colombia

Companies with total assets above 100,000 UVT must register their databases in the National Database Registry (RNBD) of the SIC, with data categories, purposes, security measures and international transfers, and keep the registration up to date. The records of processing provide this information.

Example: result of a 30-minute interview with HR

Processing activity	Purpose in one sentence	Process owner
Recruitment	Select applicants for open positions	Head of HR
Payroll	Pay salaries and meet tax and social security obligations	Payroll officer
Time recording	Record working hours and absences	Head of HR
Personnel files	Manage the employment relationship	Head of HR
Training	Plan and document employee training	HR development

In ResGuard, create one entry per activity in the Data Inventory (RoPA) right after the interview; the details follow in the next tasks.

Task 2 — Data Categories, Data Subjects & Data Flows

Which data, about whom, from where, to whom — and in which system?

For each processing activity, describe the data and how it flows. This is where data minimisation happens: every data category has to be needed for the purpose.

What to document

Data categories: e.g. contact data, bank details, health data — and whether sensitive data is involved
Data subjects: employees, applicants, customers, suppliers' contacts, website visitors
Sources: collected from the person, or obtained from third parties
Recipients: internal departments and external parties, e.g. tax office, payroll provider
Systems: the applications and storage locations where the data lives
Minimise: question every category — is it really needed? Remove what is not.

Example: processing activity "Payroll"

Data categories	Name, address, tax and social security number, bank details, salary, sick days
Sensitive data	Sick days (health) — only the number of days, no diagnosis
Data subjects	Employees, former employees
Sources	Employee, time recording, HR
Recipients	Payroll provider, bank, tax and social security authorities
Systems	Payroll software, HR file share

Minimisation found: the payroll export also contained private phone numbers and emergency contacts — not needed for payroll, so they are removed from the export.

Task 3 — Purposes & Legal Basis

"Business purposes" is not a purpose. Be specific — and name the legal basis.

Every processing activity needs a specific purpose and a legal basis that the applicable law accepts. The purpose also limits what you may do with the data later.

How to do it

Describe the purpose specifically: "pay salaries and report to tax authorities", not "HR administration"
Assign the legal basis the applicable law offers, e.g. contract, legal obligation, legitimate interest or consent
Legitimate interest: document the balancing of your interest against the rights of the person
No new purposes that are incompatible with the original one — e.g. using applicant data for marketing

Legal basis in your jurisdiction

Colombia

Prior, express and informed authorisation of the data subject is the rule, and the controller must be able to prove it. Exceptions include legal or judicial orders, medical emergencies, public data and historical, statistical or scientific purposes.

Example: purposes and legal bases

Processing activity	Specific purpose	Typical legal basis
Payroll	Pay salaries, report to tax and social security authorities	Contract and legal obligation
Recruitment	Select applicants for an open position	Steps before entering into a contract
Newsletter	Send product news to subscribers	Consent
Video surveillance	Protect the warehouse against theft	Legitimate interest, with documented balancing

Task 4 — Consent Management

Consent only counts if you can prove it — and withdrawing it is as easy as giving it.

For every processing activity based on consent, document how consent is obtained, recorded and withdrawn. Without proof, the processing has no legal basis.

What to document

Obtaining: freely given, specific, informed and given by a clear action — no pre-ticked boxes, no consent hidden in terms and conditions
Recording: who consented, when, to which text (version) and through which channel, so it can be proven later
Withdrawing: as easy as giving it, and processing stops after the withdrawal
Special rules: e.g. for children, sensitive data or electronic marketing

Example: newsletter sign-up

Obtained: unticked checkbox on the website with a short text and a link to the privacy notice, confirmed by e-mail (double opt-in)
Recorded: e-mail address, date and time of sign-up and confirmation, version of the consent text, source "website footer"
Withdrawn: unsubscribe link in every newsletter, takes effect immediately; the address is kept on a suppression list only
Not valid: adding all customers to the newsletter because they once bought something

Task 5 — Retention Periods & Transfers

How long do you keep it — and does it leave the country or the group?

Complete each processing activity with its retention period and its transfers. They are the basis for the retention schedule in Workshop 6 and the transfer checks in Workshop 10.

What to document

Retention period: a fixed period or the criteria to determine it, and the event that starts it (e.g. end of contract)
Transfers to other countries: the recipient countries, including cloud services and support teams with access from abroad
Transfers within the group: e.g. a shared HR or CRM system run by the parent company

In ResGuard: transfers are recorded in Supplier Management, the module for third parties and vendors. Create each recipient there, such as a vendor, a group company or another third party, with its country, and link it to the processing activity in the RoPA.

Transfers in your jurisdiction

Colombia

Colombian law distinguishes a transfer (transferencia) to another controller from a transmission (transmisión) to a processor, which needs a transmission contract. International transfers are only allowed to countries with an adequate level of protection according to the SIC, unless an exception applies (e.g. express authorisation of the data subject or a contract with them); otherwise, a declaration of conformity from the SIC is needed.

Example: retention and transfers

Processing activity	Retention period	Transfers
Payroll	Period required by tax and social security law, from the end of the year	Payroll provider in the same country
Recruitment	A few months after the position is filled, longer only with the applicant's consent	None
Newsletter	Until consent is withdrawn	E-mail marketing service hosted abroad
CRM	Duration of the customer relationship plus statutory periods	Group CRM operated by the parent company

The exact periods depend on your tax, accounting and employment laws — record the law next to each period.

Task 6 — RoPA Review & Maintenance

A RoPA that is out of date is worse than none — it gives false confidence.

The records are only useful if they stay current. Give every processing activity an owner, a review cycle and clear triggers for updates.

How to keep it current

Owner: one responsible person per processing activity, usually the process owner
Review cycle: e.g. once a year, owners confirm or update their entries
Update triggers: new systems, new purposes, new vendors or organisational changes
DPO review: review the completed RoPA together with the DPO before closing the workshop

Example: an update trigger in practice

Trigger: marketing wants to use a new webinar tool for customer events
RoPA: the owner of "Events" adds the tool as system and recipient, and checks whether data leaves the country
Vendor: the tool provider is assessed and a processing contract is signed (Workshop 10)
Notice: the privacy notice for event participants is updated (Workshop 4)
Tip: make "RoPA updated?" a question in your IT and purchasing approval process

Task 7 — Workshop Review & Close-out

Can every process owner answer these questions for their activities?

Expected result of Workshop 3: all processing activities of all departments are recorded with data, data subjects, purpose, legal basis, retention period, transfers and an owner.

Quick check

Marketing records "Customer data — for business purposes". What is missing?
The application form asks for date of birth and a photo. Are they needed for the purpose?
A customer unsubscribes from the newsletter. What happens to their consent record?
IT moves the file server to a cloud provider abroad. Which RoPA entries change?
Which records requirement applies to you in Colombia?

Close out the workshop in ResGuard

Confirm the expected result of every task together with the data protection lead
Attach evidence to the completed tasks: interview notes, RoPA export, consent records
Record open points as new tasks with an owner and a due date
Set all tasks and the objective Data Protection Workshop 3 to completed
Next: Workshop 4 — Privacy Notices & Transparency, which builds directly on this RoPA