Please note: This sample only shows part of the Example Personal Data Analysis Form.
REF PROJECTOR BUSINESSPROCESS PERSONAL DATAITEM DESCRIPTION SPECIALCATEGORY OFPERSONALDATA? ARTICLE9(2)EXCEPTION USED(SPECIAL CATEGORYDATAONLY) OBTAINED FROMDATA SUBJECT? OWNER PROCESSINGPURPOSE LAWFUL BASISOF PROCESSING IFCONSENT-BASED, HOWISCONSENT OBTAINED? AUTOMATED DECISIONMAKING? LEVELOFDATA SUBJECT ACCESS LOCATIONSTORED COUNTRY STOREDIN RETENTION PERIOD ENCRYPTION LEVEL ACCESS CONTROLS THIRD PARTIES SHAREDWITH COMMENTS 1 Websitesale Customer name Thenameofthecustomer; sometimesdifferentto thenameoftheperson receivingsupport No Notapplicable Yes Salesand Marketing Manager Salesrecordsand ongoingsupport Contractual Notapplicable No Accessedvia portal Webserver Salesspreadsheet onFileSharing Website Germany 7years None 2FA None 2 Websitesale Customer emailaddress Emailaddressofthe customer;usuallya businessemailbutoftena gmailorhotmailaccount No Notapplicable Yes Salesand Marketing Manager Salesrecordsand ongoingsupport Contractual Notapplicable No Accessedvia portal Webserver Salesspreadsheet onFileSharing Website Germany 7years None 2FA None 3 Websitesale Customer telephone number Phonenumber,usually businessbutcouldbe personal No Notapplicable Yes Salesand Marketing Manager Backupcontactifemail doesn'twork dowe needthis? Contractual Notapplicable No None Webserver Germany 7years None 2FA None 4 Websitesale Creditcard details Number,expiryandCVCof customer'screditcard No Notapplicable Yes Salesand Marketing Manager Sale-detailsarenot keptbyus. Contractual Notapplicable No None Payment Processor NotKnown 7years Atrest 2FA None 5 Websitesale Customer address Physicaladdressincluding street,city,county,zipand country No Notapplicable Yes Salesand Marketing Manager Salesapprovalvia creditcard;taxrecords; VATcharging Contractual Notapplicable No Canbe amendedbut notviewedvia portal Webserver Germany 7years None 2FA None 6 Websitesale CustomerIPaddressIPaddressofthepurchaser atthetimeofpurchase No Notapplicable Yes Salesand Marketing Manager Evidenceoflocation fortaxpurposes EUlaw Notapplicable No None Webserver Germany 7years None 2FA None Maynotbe genuineIP addressif proxyserveris beingused. 7 Post-salereview requests Customer nameand emailaddress Nameandemailaddress ofthecustomer;usuallya businessemailbutoftena gmailorhotmailaccount No Notapplicable Yes Salesand Marketing Manager Post-salesmarketing ofadditionalproducts Consent Notobtained No None ReviewsWebsite NotKnown 7years NotKnown 2FA Reviews Website 8 Newsletter Customer nameand emailaddress Nameandemailaddress ofthecustomer;usuallya businessemailbutoftena gmailorhotmailaccount No Notapplicable Yes Salesand Marketing Manager Post-salesmarketing ofadditionalproducts Consent Customerexplictly signsupforthe newsletter No Unsubscribe availableat anytime Webserver Germany 7years None 2FA None 9 Provisionof productupdates Customer nameand emailaddress Maybedifferenttothe purchaser No Notapplicable Yes Product Manager Communicationthatan updateisavailable Contractual Notapplicable No Accessedvia portal Webserver Germany 7years None 2FA None 10 Feedbacksurvey requests Customer nameand emailaddress No Notapplicable Yes Product Manager Post-saleandannual feedbacksurveyissuesand improvements Consent Notobtained No None MailingWebsite NotKnown 7years NotKnown 2FA Mailing Website PersonalData
GDPR-FORM-03-2 DATE COMPLETED: [Enterdatehere] A.N.Other PROJECTORBUSI... Feedbacksurveyre... HumanResources LinkedInConnections Newsletter Post-salereviewre... PERSONALDATA... Creditcarddetails Customeraddress Customeremailad... CustomerIPaddress Customername OWNER ManagingDirector ProductManager SalesandMarketingM... LAWFULBASISO... Consent Contractual EUlaw
AnalysisForm
Actions
The following actions have been identified from the Personal Data Analysis Form:
REF DATE RAISED ASSESSMENT REF ACTION WHO BY WHEN NARRATIVE STATUS 1 dd/mm/yyyy 3 Decide if telephone number is required to be captured ANO dd/mm/yyyy Open 2 dd/mm/yyyy 4 Find out where Payment Processor stores its data ANO dd/mm/yyyy Open 3 dd/mm/yyyy 7,10 Obtain consent for post-sale review requests and feedback survey requests ANO dd/mm/yyyy Open 4 dd/mm/yyyy 7 Find out where Reviews Website stores its data and whether its encrypted ANO dd/mm/yyyy Open 5 dd/mm/yyyy 10 Find out where Mailing Website stores its data and whether its encrypted ANO dd/mm/yyyy Open 6 dd/mm/yyyy 11 Find out where File Sharing Website stores its data ANO dd/mm/yyyy Open 7 dd/mm/yyyy 15 Ask Payroll Bureau about the controls they have in place, including any certifications ANO dd/mm/yyyy Open