Please note: This sample only shows part of the Example Personal Data Analysis Form. DATE COMPLETED:
Personal Data Analysis Form
[Enter date here] A. N. Other
GDPR-FORM-03-2
REF PROJECT OR PERSONAL BUSINESS PROCESS DATA ITEM
DESCRIPTION
SPECIAL CATEGORY ARTICLE 9(2) EXCEPTION OBTAINED OWNER OF PERSONAL DATA? USED (SPECIAL FROM DATA CATEGORY DATA ONLY) SUBJECT? The name of the customer; No Not applicable Yes Sales and sometimes different to Marketing the name of the person Manager receiving support
PROJECT OR BUSI...
PERSONAL DATA ...
OWNER
LAWFUL BASIS O...
Feedback survey re...
Credit card details
Managing Director
Consent
Human Resources
Customer address
Product Manager
Contractual
LinkedIn Connections
Customer email ad...
Sales and Marketing M...
EU law
Newsletter
Customer IP address
Post-sale review re...
Customer name
PROCESSING PURPOSE LAWFUL IF CONSENT- BASED, AUTOMATED LEVEL OF DATA LOCATION STORED COUNTRY RETENTION BASIS OF HOW IS CONSENT DECISIONSUBJECT STORED IN PERIOD PROCESSING OBTAINED? MAKING? ACCESS Sales records and Contractual Not applicable No Accessed via Web server Germany 7 years ongoing support portal Sales spreadsheet on File Sharing Website
ENCRYPTION ACCESS LEVEL CONTROLS None
2FA
THIRD COMMENTS PARTIES SHARED WITH None
1 Website sale
Customer name
2 Website sale
Customer Email address of the email address customer; usually a business email but often a gmail or hotmail account Customer Phone number, usually telephone business but could be number personal Credit card Number, expiry and CVC of details customer's credit card
No
Not applicable
Yes
Sales and Marketing Manager
Sales records and ongoing support
Contractual
Not applicable
No
Accessed via portal
No
Not applicable
Yes
No
None
Not applicable
Yes
Backup contact if email Contractual doesn't work - do we need this? Sale - details are not Contractual kept by us.
Not applicable
No
Not applicable
No
None
5 Website sale
Customer address
Physical address including street, city, county, zip and country
No
Not applicable
Yes
Sales and Marketing Manager Sales and Marketing Manager Sales and Marketing Manager
Sales approval via Contractual credit card; tax records; VAT charging
Not applicable
No
6 Website sale
Customer IP address IP address of the purchaser at the time of purchase
No
Not applicable
Yes
Sales and Marketing Manager
Evidence of location for tax purposes
EU law
Not applicable
7 Post-sale review requests
Customer Name and email address name and of the customer; usually a email address business email but often a gmail or hotmail account Customer Name and email address name and of the customer; usually a email address business email but often a gmail or hotmail account Customer May be different to the name and purchaser email address
No
Not applicable
Yes
Sales and Marketing Manager
Post-sales marketing Consent of additional products
No
Not applicable
Yes
Sales and Marketing Manager
No
Not applicable
Yes
Customer name and email address
No
Not applicable
Yes
3 Website sale
4 Website sale
8 Newsletter
9 Provision of product updates
10 Feedback survey requests
Web server Sales spreadsheet on File Sharing Website Web server
Germany 7 years
None
2FA
None
Germany 7 years
None
2FA
None
Payment Processor
Not Known 7 years
At rest
2FA
None
Germany 7 years
None
2FA
None
No
Can be Web server amended but not viewed via portal None Web server
Germany 7 years
None
2FA
None
Not obtained
No
None
Reviews Website
Not Known 7 years
Not Known
2FA
Reviews Website
Post-sales marketing Consent of additional products
Customer explictly signs up for the newsletter
No
Unsubscribe available at any time
Web server
Germany 7 years
None
2FA
None
Product Manager
Communication that an Contractual update is available
Not applicable
No
Accessed via portal
Web server
Germany 7 years
None
2FA
None
Product Manager
Post-sale and annual feedback survey issues and improvements
Not obtained
No
None
Mailing Website
Not Known 7 years
Not Known
2FA
Mailing Website
Consent
May not be genuine IP address if proxy server is being used.