Personal Data Processing Record

This register is the inventory step in a larger programme. Using it to do the work of a neighbouring template - assessing a new system, recording a breach, answering a request - produces an inventory entry with the wrong content and leaves the actual duty undischarged.

ISO/IEC 27701 requires PIMS-specific controls for PII controllers under clause 7.2, and clause 7.2.8 specifically calls for records related to the processing of PII - the same functional obligation most jurisdictions separately mandate as a record or register of processing activities. The standard names what the record must contain, not the form it must take.

The duty to keep a record of processing exists in most comprehensive privacy regimes, though what triggers it and what it must contain differs by jurisdiction.

The register can be filled in without anyone having gone looking for the data that is hardest to find. The judgement calls are about what counts as an activity and how far to chase down what is actually held.

The register almost always exists. What an audit tests is whether it covers the activities that were never framed as personal data processing at all.

A warehouse operator's processing register listed payroll, recruitment and access control as its three activities, each scored Yes across purpose, lawful basis and retention. An ANPR camera system covering the yard had gone live eight months earlier, installed by facilities to track trailer movements, and had never been logged because nobody involved considered it a personal data activity.

A subject access request from a former driver asking for footage of a specific date exposed the gap: the register said nothing about the camera system, retention for the footage had never been set, and the operator could not confirm how long it had actually been kept. The fix was not a better register template; it was routing every new monitoring installation through the register as a mandatory step rather than something facilities was expected to remember on its own.

Keeping the register current is the work, not filling it in once. It slips at the exact point a new system goes live and nobody remembers the register exists to be told.

KnowComply

Holds the processing register against the retention schedule and DPIA library, and flags an activity whose retention period has drifted from the schedule it should agree with.

KnowHealth

Surfaces occupational health and wellness data holdings that the register otherwise depends on someone remembering to declare.

KnowSafe

Flags new CCTV, access control or monitoring installations at go-live so they reach the register instead of arriving only when something goes wrong.

Ella

Watches for new systems and monitoring activity going live and prompts a register entry, rather than waiting for the annual review to catch what was missed.

Processing activity

A distinct purpose for which personal data is used, the unit the register is built around - not a system or a department, since one system can support several activities with different bases and retention periods.

Lawful basis

The legal ground relied on to process personal data - consent, contract, legal obligation, vital interests, public task or legitimate interests under most GDPR-derived regimes.

Special category data

Data revealing health, biometric identity, race, religion, sexual orientation or similar, which carries additional conditions for lawful processing beyond an ordinary basis.

Data controller and processor

The controller decides why and how data is processed; the processor acts on the controller's instructions. The register records both the controller's own activities and its relationships with processors.

Cross-border transfer

Personal data processed or stored outside the jurisdiction it was collected in, including by a processor hosted overseas - the trigger is where the data goes, not where the controller sits.