RECORD OF PROCESSING ACTIVITIES IN ACCORDANCE WITH THE GENERAL DATA PROTECTION REGULATION – GDPR

MANAGEMENT AND CONTROL OF DOCUMENTS AND RECORDS
One of the measures that the Data Controller must adopt to ensure proper compliance with the principle of proactive responsibility prescribed in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons about the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”), is to create a record of the processing activities carried out within the organization. A good practice stemming from this obligation is to monitor and ensure that this record is updated regularly. 

PURPOSE

In accordance with the principle of proactive responsibility governing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons about the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter, “GDPR”), each organization is responsible for deciding the level of segregation or aggregation with which it wishes to record the processing of personal data required by its activities. It must assess the extent to which segregating its processing activities into different elements corresponds to different purposes, legal bases, and categories of data subjects. Furthermore, it is responsible for considering how to optimise data protection management within its organisation to ensure that it is useful, efficient, effective, and allows for compliance with the purpose of the legislation: that individuals whose personal data is processed can, where applicable, have effective control over it.

This document contains the record of processing activities of Benidorm City Council (hereinafter, the “City Council” or the “organisation”), in accordance with Article 30 of the GDPR and Article 31 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, “LOPDGDD”).

The record of processing activities is a tool that allows the data controller and the supervisory authority, upon request, to have an overview of all personal data processing activities carried out by an organisation. It is therefore a prerequisite for compliance with the regulations and, in that sense, an effective accountability measure. This record is structured in separate tables for each processing activity, which, in addition to including the legally established requirements of Article 30.1 GDPR, also includes the section on the legal basis for processing, as this must be documented.