Case #13: What is a record of processing activities?
Cases are examples of questions and inquiries the Guidance Function receives, which we would like to share for inspiration.
A researcher contacted the Guidance Function with a query regarding what a record of processing activities is and where it should be registered.
A record of processing activities is an administrative record of who processes personal data and for what purposes. Formerly the Danish Data Protection Agency was responsible for the statement, but since the Data Protection Regulation came into force, the responsibility passed to the institution responsible for the data (e.g. the region).
The Data Protection Regulation requires that all data controllers and data processors keep internal records of their processing of personal data. The purpose with keeping a record is to obtain an overview of the projects that are dealing with sensitive personal data. This overview is a prerequisite for complying with a number of obligations in the data protection regulation. The records must be available both in writing and digitally.
The notification of the record of processing activities is usually conducted to the institution where the project manager is employed. If the research originates from a hospital, it will most often be the region, but it could just as well be a university or a company. An approved notice gives permission to process and store sensitive personal data in relation to the research project, and you can proceed to apply for permission for data transmission and data access.
It is essential to emphasize that the requirement to keep a record of processing activities is solely intended as an “internal” obligation. Meaning that registration of the record at the Danish Data Protection Agency is only conducted on request.
For further information (in Danish), click here.
In this case, we assisted the researcher to acquire information about a record of processing activities and whom it should be registered to. We also passed on a link to the Danish Data Protection Authority’s guide, where the researcher could find more information.
Please feel free to contact us if you need guidance in your research project. Our services are free, and we aim to reply to any inquiries within 2-4 working days.
The Guidance Function offers first-level support for Danish and international researchers in need of help to navigate the requirements and processes surrounding research projects.
Contact information:
Mail: info@vejledningsfunktionen.dk
Tel. +45 2494 7969
