Preview

1) Is the legal basis for each processing activity documented?
“The organization should maintain a log of each processing activity it engages in, as well as the corresponding legal basis. The processing activity has a valid legal basis only if one or more of the following apply: (a) the data subject provides valid consent; (b) processing is necessary for entering into or the performance of a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or other individual; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or third party, to the extent it does not infringe on the fundamental rights and freedoms of the data subject, particularly where the data subject is a child” - Article 6(1) EU GDPR.

2) Is the purpose for each processing activity documented?
"Every processing activity should be documented. "Processing" is defined as "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction." - Article 4(2) EU GDPR