# Privacy & staff-record handling

Review the purpose, access and retention of operational records containing personal information.

Source review: 2026-10-27

Operational starters in English. References identify their own jurisdiction. Select the rules that apply to your site, adapt the documents, and obtain competent approval before use.

## Know which operational records contain personal data

Training records, signatures, photographs and incident reports may contain personal information. Identify the purpose and categories of information before creating a new form. CNIL explains how a processing register documents activities, recipients, retention and security. This starter reviews an operational record; it is not a complete GDPR processing register.

## Separate useful evidence from unnecessary detail

Ask what information is actually needed for the operational decision. A general walkaround may need a location and defect reference without an identifiable photograph of a worker. Keep sensitive supporting information in the appropriate restricted process rather than copying it into broadly shared templates.

## Review access and retention deliberately

Record who needs access, why, and the approved retention decision with its source. Do not apply one generic retention period to every type of record. Statutory duties, claims, business purposes and data protection requirements can affect the decision. Assign unclear questions to the responsible privacy role.

## Keep changes and requests connected

Review the record when a new field, sharing arrangement or processor is introduced. Link access or deletion requests and incidents to the approved privacy process. The template records the review decision; it does not automatically change system permissions, enforce deletion or establish legal compliance.

## SOP starter: Personal-information review for operational records

Status: DRAFT — complete site-specific details and obtain approval before use.

Site: __________
Owner: __________
Version: __________
Approved by / date: __________
Next review / trigger: __________

### Preparation

- Identify the record type, purpose, responsible manager and privacy contact.

- Reference the applicable processing register, access policy and retention decision.

- Confirm the route for sensitive information, requests and incidents.

### Procedure

1. List the personal information collected and the operational purpose for each category.

2. Remove unnecessary fields from the proposed form before use.

3. Review the intended recipients, access arrangement and supporting restricted records.

4. Record the approved retention decision and unresolved questions.

5. Refer requests or suspected incidents to the approved privacy process.

6. Reassess before adding new data, sharing arrangements or processing tools.

### Records

- Record-purpose and data-category review

- Access and retention decision references

- Questions, approval and change review

### Review triggers

- New data field or processing purpose

- New recipient or processor

- Request, incident or retention-policy change

## Editable templates

- [Personal data in operational records review](https://kivloo.com/template-library/personal-data-record-review)

- [Compliance obligations and applicability register](https://kivloo.com/template-library/compliance-obligations-register)

## Official references

- [CNIL: records of processing activities](https://www.cnil.fr/fr/RGPD-le-registre-des-activites-de-traitement) — France / EU GDPR context; assess applicability; Official guidance

Canonical: https://kivloo.com/template-library/packs/privacy-records