01
The starting point: the register, then the controls
When an SMB has to start data protection from scratch, it helps to begin with a record of processing activities listing the purpose, data categories and recipients of each activity, then add organizational measures (training, internal policies, information classification) and technical measures (authentication, encryption, backups, limiting access). The required security level stays the same regardless of the equipment used, including personal devices authorized to access the company network.
02
Why start from the register, not a list of tools
The register gives an overview of the activities that process personal data and is the responsibility of the organization's manager; it must remain available to the data protection authority of the EEA country where it operates, if requested. Building it first helps clarify which risks actually need covering: from a single incident affecting availability, integrity or confidentiality of data to a full compromise of the information system through intrusion or malware.
03
The sequence to launch the register and the connected controls
Steps
- List in the register every activity that processes personal data, indicating purpose, data categories and recipients with access, such as payroll or badge management.
- Note, where possible, the retention period and a general description of the security measures already in place for each activity.
- Define a binding internal policy describing data protection and security rules, integrated into internal regulations.
- Manage access authorizations with unique identifiers, authentication, and periodic review of permissions.
- Train data handlers and protect devices, including authorized personal ones, with encryption, backups and updated antivirus.
04
Hypothetical example: a small bookkeeping office
A hypothetical office that handles payroll for a few clients could start by recording this activity with its purpose, the data categories processed and who has access. If a staff member checks the data from their own personal laptop, the office can apply the same logic suggested by the EDPB: authorize access only with dedicated authentication and encrypt the data on the device, maintaining the same level of protection expected for company computers.
05
Checklist to verify the register is operational
- Is every activity that processes personal data listed in the register with purpose and data categories?
- Are the recipients with access to each activity correctly indicated?
- Is the retention period, where possible, noted for each activity?
- Is there a binding internal policy known to all data handlers?
- Are outdated access authorizations removed and active ones periodically reviewed?
06
What management software can support
A software partner can help structure the information the register requires: list of processing activities, purpose, data categories, internal recipients and any retention periods. These are operational choices the company can configure together with its provider, not legal automations: defined access roles, traceability of authorization changes, and a periodic review point remain organizational decisions of management.
07
Frequently asked questions
Who must keep the record of processing activities? Responsibility lies with the organization's manager, and the record must remain available to the data protection authority of the EEA country where it operates, if requested.
Should employees' personal devices be protected like company devices? Yes: the security level of personal data processed must be the same regardless of the equipment used, including authorized BYOD devices.
Must occasional activities always be recorded? Organizations with fewer than 250 people do not necessarily need to mention purely occasional activities, such as data processed for one-off events.
08
Practical next step
Pick a single business activity that processes personal data, add it to the record of processing activities, and verify who actually has access to it today before moving to the next one.
FAQ
Frequently asked questions
Who is responsible for the security of data stored on employees' personal devices?
The employer remains responsible for the security of company data even if it is on personal devices, provided it has authorized access to IT resources.
What minimum information must the record of processing activities contain?
Purpose of processing, data categories, recipients with access, any transfers outside the EEA, retention period where possible, and security measures.
What kind of organizational measures concretely help reduce risks?
Regular training of data handlers, a binding internal policy, classification of confidential information, and a regularly updated risk management sheet.
✓