What is documentation?

In detail

• What does the EU GDPR say about documentation?
• Why is documentation important?

What does the EU GDPR say about documentation?

The accountability principle requires you to demonstrate that your organisation processes personal data in line with the UK GDPR. To help you do this, you can implement several technical and organisational measures. One such measure is contained in Article 30, which says that an organisation shall:

“…maintain a record of processing activities under its responsibility.”

There are several specified areas where records must be maintained, such as the purposes of processing personal data, data sharing and retention. This is what we mean by documentation.

Why is documentation important?

Documenting your processing activities is important for several reasons. First, it is a legal requirement. Although you do not need to proactively provide these records to the ICO, you may have to make the information available on request; for example, for an investigation. As a key element of the accountability principle, documenting your processing activities can also help you to ensure (and demonstrate) your compliance with other aspects of the UK GDPR. For instance, it can help you with the following things:

• Drafting your privacy notice – much of the information you have to document is very similar to what you need to tell people in your privacy notice.
• Responding to access requests – knowing what personal data is held and where it is will help you to efficiently handle requests from individuals for access to their information.
• Taking stock of your processing activities – this will make it much easier for you to address other matters under the UK GDPR such as ensuring that the personal data you hold is relevant, up to date and secure.

However, it’s not just about legal compliance with the UK GDPR; documentation will also help you do the following:

• Improve data governance – highlighting and addressing data protection matters through documentation will support good practice in data governance. This can give you assurance as to data quality, completeness and provenance.
• Increase business efficiency – knowing what personal data you hold, why you hold it and for how long, will help you to develop more effective and streamlined business processes.