Record Keeping

Under the General Data Protection Regulation (GDPR), also known in German as the Datenschutz-Grundverordnung (DSGVO), maintaining accurate and comprehensive records of data processing activities is a fundamental requirement for organizations. This section outlines the importance of record keeping, the types of records that must be kept, and how Sonat approaches these obligations to ensure compliance and transparency in its data processing activities.

Importance of Record Keeping

Record keeping is crucial for demonstrating compliance with the GDPR/DSGVO's accountability principle. It requires organizations to be able to show how they comply with the data protection principles, including how they process personal data, the legal basis for processing, and how they protect data subjects' rights. Accurate records help in assessing the effectiveness of data protection measures and are essential during audits or inspections by supervisory authorities.

Types of Records Required

The GDPR mandates that certain records be kept by both data controllers and data processors. These records include, but are not limited to:

1. The name and contact details of the organization, any joint controllers, the Data Protection Officer (DPO), and any data processors.
2. Purposes of the processing activities, detailing why the data is being processed.
3. Descriptions of the categories of data subjects and the categories of personal data.
4. Categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organizations.
5. Transfers of personal data to a third country or an international organization, including the identification of that third country or international organization and, in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), the documentation of suitable safeguards.
6. Retention schedules indicating the time limits for erasure or periodic review dates.
7. A general description of the technical and organizational security measures in place to protect personal data.

Sonat's Approach to Record Keeping

At Sonat, we have implemented comprehensive measures to ensure our record-keeping practices are in full compliance with GDPR/DSGVO requirements:

• Centralized Documentation: We maintain a centralized system for documenting our data processing activities, ensuring easy access and management of records.
• Regular Audits and Reviews: Our data processing records are subject to regular audits and reviews to ensure they remain accurate, complete, and up to date. This process also helps identify any potential compliance issues or areas for improvement in our data protection practices.
• Data Mapping: We conduct thorough data mapping exercises to identify and document the flow of personal data through our organization. This helps in creating detailed records of processing activities.
• Training and Awareness: We ensure that our staff are trained on the importance of record keeping under GDPR/DSGVO. Employees responsible for handling personal data are particularly trained in maintaining accurate and detailed records.
• Data Protection Impact Assessments (DPIAs): Where processing is likely to result in a high risk to the rights and freedoms of individuals, we conduct DPIAs and document the outcomes as part of our record-keeping obligations.

Conclusion

Effective record keeping is a cornerstone of GDPR/DSGVO compliance. At Sonat, we take this responsibility seriously, ensuring that our documentation of data processing activities is thorough, transparent, and accessible. This not only helps us comply with legal requirements but also strengthens the trust our customers, employees, and partners have in our commitment to data protection and privacy.