Scribd
Upload
168 views22 pages

GDPR ROPA Template Overview

The document outlines the roles and responsibilities related to data processing activities, including recruitment, marketing, sales, support, and product management. It details the legal basis for processing personal data, retention periods, and the involvement of sub-processors. Additionally, it emphasizes the importance of informing individuals about data processing and the security measures in place for data protection.

Uploaded by

soudaki Abderrahmane
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as XLSX, PDF, TXT or read online on Scribd
168 views22 pages

GDPR ROPA Template Overview

The document outlines the roles and responsibilities related to data processing activities, including recruitment, marketing, sales, support, and product management. It details the legal basis for processing personal data, retention periods, and the involvement of sub-processors. Additionally, it emphasizes the importance of informing individuals about data processing and the security measures in place for data protection.

Uploaded by

soudaki Abderrahmane
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as XLSX, PDF, TXT or read online on Scribd

Name and contact details Data Protection Officer (if applicable)

Name Name
Address Address
Email Email
Registry code Telephone
Data Protection Officer (if applicable)
Processing activity Department

EXPLANATION LINE (TO BE DELETED)

Recruitment and hiring


Background checks
Candidate selection
Payroll
Performance management
HR
Employee benefits administration
Access management
Termination

Website visitor tracking


Retargeting
Marketing

Prospecting/lead generation
Email campaigns
Cold-calling
Sales
LinkedIn sales

Email support
Phone support
Chat support Support

Customer research
User analytics Product and engineering
Purpose of processing Categories of individuals

Why do you need to handle this personal See drop-down menu and add options if
data? Free text necessary
Categories of personal data Legal basis for processing

1. You need to process the data in order to


perform your obligations under a contract
with the data subject.
2. You are required by law to process that
See drop-down menu and add options if data for this purpose
necessary 3. You have a valid reason to process the
data for this purpose that is more
significant than the infringement upon the
person's privacy
4. The person has consented
Explanation or evidence
Links to DPIA (if applicable)
for legal basis

Explain why it is appropriate, for consent-


N/A unless it is considered a risky
based processing indicate where to find
processing activity
evidence of consent
How are individuals informed of Qminder
The source of the personal data
processing their data?

Obligation to inform data subjects They


In most cases the individual but should have a link to the relevant privacy
might be a service provider as well notice (candidates, employees, users,
visitors?)
Reasoning or note on status of
Retention period Sub-processors
retention implementation

When will you delete the


Service providers that handle
data? Can be dynamic - e.g. Why are you keeping the data for
personal data in order to
3 years after the end of the so long?
facilitate this processing activity
contract)
Sub-processor jurisdiction (and
Link to contract with processor
mechanism for non-EEA transfers)

Where are they located (legal entity)? DPAs + data transfer mechanisms
Security measures implemented by sub-
processors

Normally a security certification but can be


some white paper or questionnaire or part
of the contract (an annex)
Processing activity Name and contact details of controller
Service provided to customers [Description of where to get these]
Service analytics for customers
...
Link to contract with controller Sub-processors (if applicable)
Terms? Custom contracts?
Sub-processor jurisdiction (and
Links to sub-processor contracts
mechanism for non-EEA transfers)
Security measures implemented by sub-
processors (Qminder TOMs are described
in the SOC 2 report)

You might also like