Know which operational records contain personal data
Training records, signatures, photographs and incident reports may contain personal information. Identify the purpose and categories of information before creating a new form. CNIL explains how a processing register documents activities, recipients, retention and security. This starter reviews an operational record; it is not a complete GDPR processing register.
Separate useful evidence from unnecessary detail
Ask what information is actually needed for the operational decision. A general walkaround may need a location and defect reference without an identifiable photograph of a worker. Keep sensitive supporting information in the appropriate restricted process rather than copying it into broadly shared templates.
Review access and retention deliberately
Record who needs access, why, and the approved retention decision with its source. Do not apply one generic retention period to every type of record. Statutory duties, claims, business purposes and data protection requirements can affect the decision. Assign unclear questions to the responsible privacy role.
Keep changes and requests connected
Review the record when a new field, sharing arrangement or processor is introduced. Link access or deletion requests and incidents to the approved privacy process. The template records the review decision; it does not automatically change system permissions, enforce deletion or establish legal compliance.
Start with the records you need.
Open an editable draft in Kivloo. Add your site, methods, limits and responsibilities, then save it to your workspace. Downloads remain free without an account.
Personal data in operational records review
Review the purpose, personal-data categories, recipients, access and retention decision for an operational record.
Compliance obligations and applicability register
Record which requirements apply to a site, why, who owns them and what evidence needs review.
Personal-information review for operational records
Complete the site, owner, version, approver and review details in the downloaded document before putting this procedure into use.
Before you start
- Identify the record type, purpose, responsible manager and privacy contact.
- Reference the applicable processing register, access policy and retention decision.
- Confirm the route for sensitive information, requests and incidents.
Procedure
- List the personal information collected and the operational purpose for each category.
- Remove unnecessary fields from the proposed form before use.
- Review the intended recipients, access arrangement and supporting restricted records.
- Record the approved retention decision and unresolved questions.
- Refer requests or suspected incidents to the approved privacy process.
- Reassess before adding new data, sharing arrangements or processing tools.
Records to keep connected
- Record-purpose and data-category review
- Access and retention decision references
- Questions, approval and change review
Review triggers
- New data field or processing purpose
- New recipient or processor
- Request, incident or retention-policy change