Summary
In short
- A personal data processing record is a register used in KnowComply that records what personal data the organisation holds, why, on what basis and for how long. It is built against ISO 27701 cl.7.2 and forms part of the Data Protection and Information Security programme.
- Reviewed yearly. Owned by the privacy lead.
- The template holds 41 fields across 6 sections.
- Scoring is records complete, where high is good.
- ISO is international Organization for Standardization. A voluntary international standard. Widely adopted, often required by customers, and certifiable where a management system standard.
- It connects to the rest of the library: links Records retention, Health records.
What it is
What it is
What is a personal data processing record?
A personal data processing record is a register used in KnowComply that records what personal data the organisation holds, why, on what basis and for how long. It is built against ISO 27701 cl.7.2 and forms part of the Data Protection and Information Security programme.
When is a personal data processing record completed?
A personal data processing record is completed once at set up, then whenever an entry is added, changed or retired. Reviewed yearly.
When to use it
When to use it, and when not to
This register is one step in a larger programme. Using it for work that belongs to a neighbouring template produces records that are hard to report on later.
Use it for
- The event or activity this register covers has occurred, or is about to
- A new record is needed; each one gets its own ID in the form PDP-2026-000
- You are running the Data Protection and Information Security programme and this is one of its steps
- A linked record needs this one to exist: links records retention, health records
Not for
- Data Protection Impact Assessment, which assesses the privacy impact of a new system or monitoring activity before it is introduced.
- Data Breach Record, which records loss, exposure or unauthorised access to personal data, with the assessment of harm and notification decision.
- Subject Access Request Record, which records a request from an individual for the data held about them, and how it was answered within the deadline.
- Anything outside KnowComply, which belongs in the workspace that owns that process
Standards
What it is built against
ISOInternational Organization for Standardization
A voluntary international standard. Widely adopted, often required by customers, and certifiable where a management system standard.
FAQ
Frequently asked questions
What is the personal data processing record template based on?+
It is built against ISO 27701 cl.7.2. ISO is international Organization for Standardization. A voluntary international standard. Widely adopted, often required by customers, and certifiable where a management system standard.
What sections does the personal data processing record contain?+
There are 6 sections: header, completeness, for each activity, governance, related records, outcome. Together they hold 41 fields, 36 of which are required.
How often is a personal data processing record raised?+
A new record is raised once at set up, then whenever an entry is added, changed or retired. Each one is given an ID in the form PDP-2026-000, so it can be traced and referenced from other records.
Which programme does the personal data processing record belong to?+
It is part of Data Protection and Information Security. Monitoring introduced with consultation, and backups proven by restoring them.
How is a personal data processing record scored?+
Scoring is records complete. High is good. Scores exist to make the form tell you something, not to produce a percentage for its own sake.
Can the personal data processing record template be changed?+
Yes. Every field, option, score and conditional rule is editable, and the links to other templates come with it. Most teams install it as it is, run it for a cycle, then adjust.
The agents
What the agents do with it
The form is the easy part. Keeping it current, routing it to the right owner and holding the evidence together is the work that actually slips.
Holds the personal data processing record library against your registers, routes each record to its owner, and keeps the evidence trail together.
Coordinates the crew, rolls completion and exceptions into one view, and holds every write for your approval before it touches a record.
This template lives in KnowComply — audit and governance. Audit programmes, legal register, management review, risk and certification.
Sources
Sources
- ISO — International Organization for Standardization