Jurisdiction selected: Spain — GDPR + Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)
Task 1 — Identify Processing Activities
A processing activity is a business process that uses personal data for one purpose, such as payroll, recruitment or the newsletter. Short interviews with the process owners find them faster than any questionnaire.
Controllers and processors must keep records of processing activities (Art. 30 GDPR) and provide them to the supervisory authority on request. The exemption for organisations with fewer than 250 employees does not apply if the processing is not occasional, involves special categories or is likely to result in a risk, so in practice almost every organisation needs one.
| Processing activity | Purpose in one sentence | Process owner |
|---|---|---|
| Recruitment | Select applicants for open positions | Head of HR |
| Payroll | Pay salaries and meet tax and social security obligations | Payroll officer |
| Time recording | Record working hours and absences | Head of HR |
| Personnel files | Manage the employment relationship | Head of HR |
| Training | Plan and document employee training | HR development |
In ResGuard, create one entry per activity in the Data Inventory (RoPA) right after the interview; the details follow in the next tasks.
Task 2 — Data Categories, Data Subjects & Data Flows
For each processing activity, describe the data and how it flows. This is where data minimisation happens: every data category has to be needed for the purpose.
| Data categories | Name, address, tax and social security number, bank details, salary, sick days |
| Sensitive data | Sick days (health) — only the number of days, no diagnosis |
| Data subjects | Employees, former employees |
| Sources | Employee, time recording, HR |
| Recipients | Payroll provider, bank, tax and social security authorities |
| Systems | Payroll software, HR file share |
Minimisation found: the payroll export also contained private phone numbers and emergency contacts — not needed for payroll, so they are removed from the export.
Task 3 — Purposes & Legal Basis
Every processing activity needs a specific purpose and a legal basis that the applicable law accepts. The purpose also limits what you may do with the data later.
Six legal bases (Art. 6 GDPR): consent, performance of a contract, legal obligation, vital interests, public task and legitimate interests. Consent is only one of them and is often not the best choice, e.g. in employment relationships.
| Processing activity | Specific purpose | Typical legal basis |
|---|---|---|
| Payroll | Pay salaries, report to tax and social security authorities | Contract and legal obligation |
| Recruitment | Select applicants for an open position | Steps before entering into a contract |
| Newsletter | Send product news to subscribers | Consent |
| Video surveillance | Protect the warehouse against theft | Legitimate interest, with documented balancing |
Task 4 — Consent Management
For every processing activity based on consent, document how consent is obtained, recorded and withdrawn. Without proof, the processing has no legal basis.
Task 5 — Retention Periods & Transfers
Complete each processing activity with its retention period and its transfers. They are the basis for the retention schedule in Workshop 6 and the transfer checks in Workshop 10.
In ResGuard: transfers are recorded in Supplier Management, the module for third parties and vendors. Create each recipient there, such as a vendor, a group company or another third party, with its country, and link it to the processing activity in the RoPA.
Within the EU/EEA, data flow freely. Transfers to other countries need an adequacy decision of the European Commission (e.g. UK, Switzerland, Japan, or US companies certified under the EU-US Data Privacy Framework), appropriate safeguards such as standard contractual clauses (SCCs) or binding corporate rules (Art. 46 GDPR), or, for occasional transfers only, an exception such as explicit consent (Art. 49 GDPR). With SCCs, a transfer impact assessment is expected. Processors need a contract under Art. 28 GDPR.
| Processing activity | Retention period | Transfers |
|---|---|---|
| Payroll | Period required by tax and social security law, from the end of the year | Payroll provider in the same country |
| Recruitment | A few months after the position is filled, longer only with the applicant's consent | None |
| Newsletter | Until consent is withdrawn | E-mail marketing service hosted abroad |
| CRM | Duration of the customer relationship plus statutory periods | Group CRM operated by the parent company |
The exact periods depend on your tax, accounting and employment laws — record the law next to each period.
Task 6 — RoPA Review & Maintenance
The records are only useful if they stay current. Give every processing activity an owner, a review cycle and clear triggers for updates.
Task 7 — Workshop Review & Close-out
Expected result of Workshop 3: all processing activities of all departments are recorded with data, data subjects, purpose, legal basis, retention period, transfers and an owner.