Privacy

Treatment register

The Register of Processing is a written document, paper or electronic, that maps processing operations, embodying the accountability of the Owner and Manager and serving as an essential basis for risk assessment and controls by the Privacy Guarantor.

Who is required to prepare the treatment record?

With the entry into force of the European Data Protection Regulation (GDPR), the figure of the Data Protection Officer ( DPO ) or Data Protection Officer was born. Article 30 of the GDPR reports that Data Controllers and Managers must prepare a Register of Processing Activities, and in particular paragraph 5 makes explicit in which cases the register is mandatory.

Enterprises or organizations with more than 250 employees, the processing carried out is likely to present a risk to the rights and freedoms of the data subject, the processing is not occasional, or includes the processing of special categories of data referred to in Article 9, or personal data relating to criminal convictions and offenses referred to in Article 10. In order to better define which subjects fall under this provision, the Privacy Guarantor, in its FAQs, by way of example and not exhaustively, lists the subjects who, in the private sphere are required to prepare the register.

Commercial establishments, public establishments or artisans with at least one employee (bars, restaurants, workshops, stores, small retailers, etc.) and/or that process customer health data (e.g., hairdressers, beauticians, opticians, dental technicians, tattoo artists, etc.);
Associations, foundations and committees where they process “special categories of data” and/or data relating to criminal convictions or crimes (i.e., trend organizations; associations for the protection of so-called “vulnerable” individuals such as the sick, persons with disabilities, ex-convicts, etc.; associations that pursue the purpose of preventing and combating gender, racial, sexual orientation, political or religious discrimination, etc.; sports associations with reference to processed health data; political parties and movements; trade unions; associations and movements of a religious nature);
The condominium where it handles “special categories of data” (e.g., resolutions for interventions aimed at overcoming and removing architectural barriers pursuant to Law No. 13/1989; claims for damages including medical expenses related to accidents that occurred within the condominium premises).
Freelancers with at least one employee and/or who process health data and/or data on criminal convictions or offenses (e.g., accountants, notaries, lawyers, osteopaths, physical therapists, pharmacists, physicians in general);

What does the treatment log contain?

The Regulations detail the information that must be contained in the controller’s register of processing activities (Art. 30(1) of the GDPR) and the controller’s register(Art. 30(2) of the GDPR).

Specifically, they can be summarized as follows:

name and contact information

The name and contact details of the Owner, Manager, and DPO.

purpose of processing

The purposes of processing and their legal basis.

categories of recipients

The categories of recipients to whom the data will be disclosed.

TRANSFER

The transfer, of personal data to countries outside the EU and its appropriate safeguards.

The Cancellation Times

Expected cancellation times.

SECURITY MEASURES

The technical and organizational security measures taken.

How should the treatment record be kept ?

Register of Processing is a document recording and analyzing the processing operations carried out by the owner or manager. As such, the register must be kept constantly updated since its content must always correspond to the actuality of the treatments put in place.

Any changes, particularly with regard to the methods, purposes, categories of data, categories of data subjects, as well as the related security measures, must be immediately entered in the Register, giving an account of the changes that have occurred.

The Register must verifiably show the date of initial establishment and the date of last update.

Our services

Privacy

No pre-packaged model, but a customized strategy that grows with your business.

Security

We support your company in countering threats to assets and human resources.

WHISTLEBLOWING

Customized and compliant handling of reports, with full support at every stage.

D.LGS. 231/2001

Organizational Models and Supervisory Bodies for the Mitigation of Administrative Liability of Legal Entities.

Privacy

Treatment register

Who is required to prepare the treatment record?

Even when it is not mandatory, the Garante recommends that it be prepared by data controllers and managers. The Registry allows for detailed mapping of operations on personal data. It provides an up-to-date and comprehensive overview of current processing.

What does the treatment log contain?

name and contact information

purpose of processing

categories of recipients

TRANSFER

The Cancellation Times

SECURITY MEASURES

How should the treatment record be kept ?

Our services

Privacy

Security

WHISTLEBLOWING

D.LGS. 231/2001