The organization must maintain written, accurate, and up-to-date records of all personal data processing activities. These records must be retained for the entire duration of the processing and for at least five years after completion. Records should be securely stored and organized to allow prompt access when requested by the competent authority.
Each record must include, at a minimum:
- The controller’s name, contact details, and where applicable, the data protection officer’s information.
- The specific purposes for which personal data is processed.
- Descriptions of the categories of personal data and data subjects involved.
- Retention periods defined for each data category, where possible.
- Categories of recipients or third parties to whom data is disclosed.
- Details of any personal data transfers outside the state, including their legal basis and intended recipients.
- A description of the organizational, administrative and technical measures implemented to protect personal data.
The organization must ensure that these records remain accurate, regularly reviewed, and readily available to demonstrate compliance with data protection requirements.
.svg)
