Categories of Elements of Source of the Purposes for Legal basis for Special categories Legal basis for Retention Action required to personal data personal data personal data which personal each processing of personal data processing period be GDPR compliant? and data included within data is purpose categories of subjects each data processed special categories personal data category of personal data) List the List each type of List the source(s) of Within each For each purpose If special categories List the legal basis on For each Identify actions that are categories of personal data the personal data category of that personal data of personal data are which special category of required to ensure all data subjects included within e.g. collected personal data list is processed, list the collected and categories of personal personal data, personal data and personal each category of directly from the purposes for legal basis on which retained, set out data are collected list the period processing operations data collected personal data e.g. individuals; from the data is it is based e.g. details of the nature and retained e.g. for which the are GDPR compliant and retained name, address, third parties (if third collected and consent, contract, of the data e.g. explicit consent, data will be e.g. this may include e.g. current banking details, party identify the retained e.g. legal obligation health, genetic, legislative basis retained e.g. deleting data where employee data; purchasing history, data controller as marketing, service (Article 6). biometric data. (Article 9). one month? one there is no further retired online browsing this information will enhancement, year? purpose for retention. employee data; history, video and be necessary to research, product customer data images. meet obligations development, As a general (sales under Article 14). systems integrity, rule data must information); HR matters, be retained for marketing advertising. no longer than database; CCTV is necessary for footage. the purpose for which it was collected in the first place.
Categories of personal data and data subjects Elements of personal data included within each data category Source of the personal data Purposes for which personal data is processed Legal basis for each processing purpose categories of personal data) Special categories of personal data Legal basis for processing special categories of personal data Retention period Action required to be GDPR compliant? List the categories of data subjects and personal data collected and retained e.g. current employee data; retired employee data; customer data (sales information); marketing database; CCTV footage. List each type of personal data included within each category of personal data e.g. name, address, banking details, purchasing history, online browsing history, video and images. List the source(s) of the personal data e.g. collected directly from individuals; from third parties (if third party identify the data controller as this information will be necessary to meet obligations under Article 14). Within each category of personal data list the purposes for the data is collected and retained e.g. marketing, service enhancement, research, product development, systems integrity, HR matters, advertising. For each purpose that personal data is processed, list the legal basis on which it is based e.g. consent, contract, legal obligation (Article 6). If special categories of personal data are collected and retained, set out details of the nature of the data e.g. health, genetic, biometric data. List the legal basis on which special categories of personal data are collected and retained e.g. explicit consent, legislative basis (Article 9). For each category of personal data, list the period for which the data will be retained e.g. one month? one year? As a general rule data must be retained for no longer than is necessary for the purpose for which it was collected in the first place. Identify actions that are required to ensure all personal data processing operations are GDPR compliant e.g. this may include deleting data where there is no further purpose for retention.
GDPR-Checklist-Templates-for-SMEs-Downloadable-1.docx