Record of processing activities (RAT): why do it if it isn't mandatory?
Let's start by acknowledging that although Chile's Law 21.719 is inspired by Europe's GDPR, it is not the same. And one of the differences is this: over there, keeping a record of personal data processing is an obligation, while in Chile it is optional. Unless you want to put together an infringement prevention model (which is entirely optional), building a RAT is optional too.
So why do so many companies put a lot of time and specialized teams into this mapping exercise? Here are the main reasons we've identified:
1. You can't comply with what you don't know about
The law is very clear about the principles and conditions you have to meet when you process data, but meeting them is almost impossible if we don't know what processing an organization actually carries out. If we sketch it out (not exhaustively, just as a guide), the areas you have to cover in data processing could look something like this:
It is a simplification, but it helps you get a sense of how important it is to have a map of your processing activities in order to comply with the new rules.
2. Reality looks very different from the documents
Some companies build their processing records from process and procedure documents, but the reality is that people adapt how they do their jobs, and that can change the way they handle data. For example: when a customer comes to pick up a product at the store, the procedure says the ID card must be photographed, but when that machine broke down, the reps serving customers started taking a photo of the ID with their phones so deliveries wouldn't be delayed. This second form of processing carries different risks from the one set out in the original procedure.
3. It's the starting point for risk management (which is mandatory)
On top of the requirements listed in the first point, another one has to do with risk management and mitigating the risks that processing creates for the data subject. Remember that data protection is about protecting the people behind the data. And when processing is invasive, the law requires you to show that the risks were assessed and minimized. For example, if I'm using someone's health data, that carries more risk than using data like their first and last name. Imagine I mistakenly send a list of data to the wrong person: which one has the bigger impact, the one with health data or the one with names? You can only assess this kind of risk if you are thorough in your record of processing activities.
But those of us who have been through a RAT mapping process know it's an exercise full of friction. That's why we're leaving you with:
5 practical tips to give this exercise more structure:
1. Document every processing activity, not just the obvious ones
Risks are often hidden, because they are actions so routine that we don't even notice them. For example: photocopying an ID card, or its newer and riskier version, taking a photo of it. That simple act can leave a door open for scams against that person, because their identity can be impersonated with the document's serial number.
That's why we need to document every activity we carry out day to day, or only now and then. Let's ask ourselves:
What activities do I do day to day at work that involve personal data (of anyone at all: customers, employees, visitors, employees' children, etc.)
What activities do I do less often that also involve personal data (for example: I send a weekly report of everyone who entered a building)
Remember that the later analysis isn't driven by how often you carry out an activity, but by its risk.
An action can be completely routine and still be risky, so it has to be documented anyway. Risk gets assessed afterwards.
2. Think about scope first, depth second
The advice is to first list every processing activity your teams carry out, so the scope is as complete as possible. Take a few minutes to cover everything you do and make sure nothing is left out.
How do you help your people think about this?
Explain the context: what you're trying to identify and why. Give them examples close to their own reality or to the job they do. What we want is for them to stop seeing their work as something automatic for a moment, and to observe and analyze it instead.
Then, with that list in hand, we document each activity in the depth the record of processing activities requires. For example, identifying where the information comes from, what it is used for, which systems are involved, and so on.
3. Do you have vendors? You have to include the activities they carry out on your behalf
A common mistake is to assume that if a vendor does the processing, responsibility was handed over with it. The law is very clear about this: if a vendor acts on our behalf, making sure that vendor complies with the rules is still our responsibility.
For the same reason, we also have to document the activities our vendors carry out. For example: I have a vendor that runs phone campaigns. That processing can be done in many ways and needs analysis, because the risks involved can differ. If the vendor works from a shared folder used to pass along the list of customers to call, that is not the same as giving it restricted access to a calling system where it never sees the full database.
4. Include automated processes
Exactly as the heading says: automated processes that involve personal data are processing too. For example, do customers get an automatic welcome email? That is processing you have to account for.
5. How do you know what to document?
With all these considerations, it's easy to get lost and not know what to document. Doubts keep coming up about which fields are really required and how much detail each activity needs.
Unfortunately, there is no single answer to this. And the answer will always be that you have to document the information you need in order to later analyze it in terms of its risk.
If it's too general, identifying the risks of each processing activity will be impossible; but if the entries are too detailed, that level of granularity will make them very hard to manage later on.
But this is where technology helps us. Soyio's Prisma IA lets us manage the information gathered in interviews with the people who use personal data day to day far more efficiently. It lets us ask a large number of employees for information in an automated way, through a natural conversation with a chatbot, and then have that information structured and analyzed automatically. All of this without taking human review out of the equation, which is needed to check that we are capturing the right, relevant information about how we operate with data in an organization.
