Data processing register and why is it necessary

Where fewer than 250 persons are employed, the company may decide whether to create one or not, unless the personal data processing by the respective organization is regular, does not concern special categories of data or personal data relating to criminal convictions and offences and does not present a risk to the rights and freedoms of individuals. 

Otherwise, based on the said factual circumstances also small businesses may have to create and maintain the register of the personal data processing activities.

Before setting up a register for the personal data processing, the organization should consider: the purpose of the processing, the legal basis for the processing, the amount of data necessary to achieve the purpose, whether the data will be transferred to third parties, whether the data will be transferred outside the European Union and the European Economic Area and information on technical and organizational measures.

There is no regulated format for the creation of such register, and therefore each organization can choose how to create and maintain it (e.g., create a separate system, excel spreadsheet or hard copy).

The amount of information to be included in the data processing register depends on the processing itself. If the purposes and means of processing personal data are determined by the organization, the following must be indicated in the register:

The organization may delegate the processing to someone else. In this case, the person to whom the data processing has been delegated must be indicated in the register, all together with the same information listed above.

Another important matter in this context is that the personal data processing register is not a document that can be drawn up, shelved, and forgotten. 

It is a document that the organization maintains and regularly updates according to the actual situation. The requirement to maintain the personal data processing register is also important because the Latvian Data State Inspectorate has the right to request it from an organization in order to verify that data processing is carried out in accordance with data protection regulation. 

And in case of discrepancies in comparing the register with actual processing or discovering any infringement, there is potential that this organization can be held administratively liable and monetary fines can be imposed.