GDPR Data Register: What you need to know
Our webinar, titled ‘GDPR: Completing the Data Register’, and hosted by Gert Beeckmans, Chief Risk & Security Officer at SD Worx, and Laurent De Surgeloose, Lead Lawyer at global law firm DLA Piper, explored the importance of data registers and what HR and payroll professionals need to know.
The data register, also referred to as a Data Inventory, Personal Data Mapping, Processing Register, Software Register, and Data Index, must be maintained by the company’s data processor and controller. Despite a new GDPR-compliant register initially seeming confusing, there are a number of ways to ensure that it is set up—and maintained—easily.
What should be logged in a data register?
Essentially, the new register needs to detail the purposes of why a company is processing data. It should include the categories of the data subjects and personal data, as well as the categories of recipients (where applicable), and the technical times and descriptions of the organisational processes.
The recipients of this data, outside of data regulation authorities, are defined as natural or legal persons to whom personal data is disclosed, whether third party or otherwise. The only exception to this rule is public authorities who receive personal data in compliance with EU or member state law, who should not be considered as recipients. With these fundamental rules in mind, your register can be built.
How easy is it to establish a register?
There is no set model that the register must be based on, leaving companies to choose whichever format they prefer, with the register either being recorded digitally or on paper. GDPR also does not require the data to be recorded in any particular language. Local data regulation authorities may have a preference on the language, but this will not be enforced by incoming GDPR legislations. Companies can also adapt current registers on pre-existing data indexes, or software register assets, to build the data register.
How to maintain a data register
By using current software that is useful and practical to the company, the process will be simplified. People outside of the organisation should be able to easily navigate the register, so data owners should ensure it remains clear to all parties.
HR and payroll teams should update this data frequently, with yearly reviews and validations. By adding in as much information as possible, including the information owner, the physical location of files/data, and information on IT applications. By doing this, if data authorities ask to see the register, organisations will be able to demonstrate in detail how all the data is managed and processed.
By including both legal obligations and additional organisational information in the register, the company’s processing not only ensures that the data register is GDPR-compliant, but also that it provides a map of the data. It equally ensures that it is easy to maintain in the long-term, as both management and recipients are clear as to what it is used for and why data is being recorded.
SD Worx aims to give guidance and provide news on this historic legislation from an HR and Payroll stand point which will impact businesses across the globe. For more information please contact us.
Related articles
Mandatory protection for whistleblowers – be prepared on time
By December 17, 2021, Belgium will need to have implemented the European Whistleblower Directive. From then on, organisations and companies must have a workable internal reporting channel in place for whistleblowers who expose abuses. Belgium is still lagging behind, but we are already taking steps to move forward.
Getting it Right: Small and Mighty Payroll
There’s a common misconception that payroll offerings are only necessary when your organisation reaches a certain size. However, small companies should not overlook partnering with a payroll provider that fits their needs, especially when they’re looking to expand into new regions.
Why choose a payroll provider with an ISAE 3000 attestation
Outsourcing HR tasks such as payroll implies handing highly valuable company and personnel information over to an external partner. How can you guarantee they handle those data professionally, with integrity and confidentiality, and in compliance with the strict EU General Data Protection Regulation (GDPR)? The answer: ISAE 3000 attestation.