Documenting Business Processes for Data Protection

How it works today in most organizations

Somewhere in the organization there is a process map. Usually quality management drew it for the ISO 9001 certification, in Visio as "Process_Map_2023.vsdx" or as a slide in "QM_Manual_Process_Landscape.pptx". It shows boxes such as sales, order processing, purchasing, HR and IT operations, connected by arrows. For the certification that is enough, and for the purpose it was drawn for, it is good.

Separately, data protection keeps the records of processing activities under Art. 30 GDPR. They contain entries such as "Applicant management", "Payroll" or "Customer service via ticket system". The records are cut by processing activity, the map by workflow. Which processing activities belong to order processing is written in neither document.

Day to day this hardly shows, because one person carries the connection in their head. When someone asks which systems purchasing depends on, the answer is: "You need to ask Ms. Berger, she knows." Ms. Berger leads the purchasing team, is the process owner according to the QM manual and is the only person who knows that supplier evaluation runs in a cloud tool whose data processing agreement (DPA) sits in the folder "Contracts/Service providers/2022".

The responsibility itself is a name in a column of the map or a sentence in the QM manual: "Responsible: head of purchasing". No deputy is planned. When the head changes, the old name stays until someone updates the slide.

On top of that there is a third list. IT or information security keeps its systems in "Asset_List_IT.xlsx", with a column "Used by" that lists departments, not processes. Three documents describe the same organization: the map by workflow, the records by processing activity, the asset list by system. Each is maintained on its own, and each is owned by a different department. Anyone who needs a connection has to rebuild it for every request.

The moment it becomes apparent

It becomes apparent when a question cuts across both documents. A major customer sends a questionnaire as part of its supplier review: "Which sub-processors are involved in handling our orders, and where are the contracts for them?" Or a service provider announces that it is moving its data center, and management wants to know which workflows are affected.

The data protection officer then goes through the records line by line, puts the process map next to them and writes emails to the departments. If the one person who knows the connection is on vacation or has left the organization, the reconstruction starts from zero. The answer to the customer then takes weeks instead of days. And with the next questionnaire the same search starts over, because the result once again lives only in an email to the customer, not in the documentation.

The target process in six steps

The goal is not a second set of records, but a connection: workflows get a document of their own, and the records, the assets and the contracts are attached to it. These six steps describe the process.

1. Set up the process map as a tree. Take the main processes from the existing map and divide them into sub-processes, for example HR with applicant management, payroll and time tracking. In preeco | data protection, business processes sit under "Processing activities"; the tree view shows the hierarchy, the table the columns and filters. Start with two levels, not five.

2. Spread responsibility across several shoulders. Every process gets a process responsibility and a deputy. Each role can hold several people and entire responsibility groups, for example the group "HR department". When someone changes jobs, the administration updates the group once, not every process.

3. Link the processing activities. In the process environment you link the processing activities that belong to a workflow. Below them, their own references appear automatically, that is assets, data processing agreements and technical and organizational measures, marked "taken over". What is maintained in the records does not need to be mapped a second time.

4. Close the gaps directly. Whatever does not appear in any processing activity is linked directly: an asset without personal data, a joint controllership agreement under Art. 26 GDPR, a data protection impact assessment (DPIA) or a past incident. At this point at the latest it becomes clear which processing activity is still missing from the records.

5. Record the dependencies. The arrow on the slide becomes a relationship with a direction: payroll "depends on" time tracking, time tracking "is required by" payroll. The dependency appears on both processes.

6. Approve and maintain as a team. Approval creates a revision as a PDF. If someone later changes the process environment, the process goes back to "In progress" until it is approved again. Questions go to the responsible people as a comment or as a task with a due date, and a review reminder prompts the annual review.

Why the process is the right organizing principle

Departments think in workflows, not in processing activities. Ask the head of purchasing about their processing activities and you get silence; ask about the workflow from purchase requisition to invoice and every system comes up on its own. That makes the process the natural entry point for questions, while the processing activity remains what Art. 30 GDPR requires.

Before and after compared directly

What the switch means in practice

The quality management process map does not have to disappear. It provides the structure, and the business processes adopt it as a tree. The effort lies less in setting things up than in clarifying content: which processing activities actually belong to the workflow, and who deputizes for the process responsibility.

In a mid-sized organization with eight to twelve main processes, the first level is set up in a morning. Linking then proceeds process by process, ideally in short sessions with the respective process owner.

Business processes are available in preeco | data protection and in preeco | information security; the two products run on the same platform. Quality management, data protection and information security therefore work on the same processes instead of reconciling three lists. Information security finds them under "Management", data protection under "Processing activities".

Three mistakes that make the switch harder than necessary

Breaking it down too finely. Anyone who creates every task as a sub-process rebuilds a process manual. For data protection, the level at which processing activities, systems and contracts differ is enough.

Linking everything directly. Link the processing activities first and check the entries taken over. Anyone who additionally attaches assets and contracts to the process by hand maintains the same information twice.

Leaving the deputy open. A process with only one responsible person has the same problem as before. Enter the deputy from the start, ideally as a group.

How to tell it is time

Separate documents are not a mistake as long as nobody asks across them. It is time for the connection if at least one of these points applies:

• Customers ask about service providers per workflow in supplier reviews.
• You cannot say which processes are affected when a service provider fails.
• The process responsibility is recorded in a document nobody has opened in over a year.
• There is no deputy for the people who know the connections.
• Quality management, information security and data protection each keep their own process lists.