2. Describe the hobby organiser’s processing of personal data with a record of processing activities

A record of processing activities is a written description of the personal data processing carried out by the organisation. Drawing up a record of processing activities makes the hobby organiser’s data protection work more systematic and helps with the documentation of processing. The record of processing activities is intended for the organisation’s internal use.

A record of processing activities must be drawn up if

the organisation has over 250 employees; or
the processing of personal data is not occasional;
the processing is likely to result in a risk to the rights and freedoms of the data subject; or
the processing includes special categories of personal data.

Hobby activities often involve the regular processing of at least participants’ and club employees’ personal data. If this is the case, such processing activities must be included in the record.

The record serves as a tool for conceptualising the processing of personal data. It can also be used to demonstrate that personal data is being processed according to data protection legislation. The record of processing activities is a separate document from the privacy statement, which is used to inform data subjects. The record is not intended for informing the data subjects directly, but can be helpful in producing information intended for data subjects.

What information must be included in the record of processing activities?

The record must include the following information:

the name and contact details of the controller and, where applicable, the joint controller, the controller’s representative and the data protection officer;
the purposes of the processing;
a description of the categories of data subjects and of the categories of personal data;
the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations;
transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1) of the GDPR, the documentation of suitable safeguards;
the envisaged time limits for erasure of the different categories of data or the criteria for determining such time limits; and
a general description of the technical and organisational security measures, such as the encryption of personal data, the ability to ensure the confidentiality, availability and resilience of information systems, as well as processes for regularly evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

Remember

Draw up a record of processing activities for the personal data processing required by the hobby activities.

The Office of the Data Protection Ombudsman has drawn up a template for the record.

The template is available on the Office of the Data Protection Ombudsman’s website: Record of processing activities.