3

Article 30 of the GDPR seems ambiguous to me, and I'd like some clarification.

See: https://www.privacy-regulation.eu/en/30.htm

It states that a data controller

...shall maintain a record of processing activities under its responsibility...

But does this mean every single thing (like every time a newsletter was sent, a customer survey email was sent, etc) or does it just mean document that you will be doing them, for instance one entry would be for newsletters, one for customer surveys, and so on?

Improve this question

1 Answer 1

Reset to default
2

The ICO actually got in touch with me after I passed this question on them. They told me that it would only be a record of what is being done.

For instance, using part of my question as an example, you would document that you'd be sending newsletters (along with the associated information about that data) in your record, but you wouldn't have to write a new record every time a newsletter was to be sent out.

Of course, when the processing changes, the record has to take that into account.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .