Software for doing the RAT in a company with many areas and systems

To do the Record of Processing Activities in an organization with many areas and systems, what works best is a tool that gathers the information from the people who operate each process and that allows it to be updated when something changes. A spreadsheet is enough in a small organization. With dozens of areas, vendors and systems, it becomes outdated before it is finished.

At Soyio we built Prisma IA for that problem: an artificial intelligence agent interviews each employee, identifies the activities they carry out with personal data and drafts the record, which the data protection team then reviews and approves.

What is the record of processing activities?

It is the map of the personal data that an organization processes: what data each area uses, for what purpose, where it comes from, with what systems it is worked on and with whom it is shared. Risks are assessed and controls are defined based on that map.

Is it mandatory in Chile?

Law 21.719 was inspired by the European regulation, but it is not the same. In Europe the record is mandatory. In Chile it becomes enforceable when the organization adopts an infringement prevention model, which is voluntary.

Even so, many large organizations are building it. The reason is practical: it is difficult to comply with the principles of the law on processing activities that are unknown. And for invasive processing, the law requires being able to demonstrate that the risk was assessed and minimized. That analysis starts from the record.

Why the spreadsheet does not work in a large organization

In an organization of this size, knowledge about data is not in a single place. It is held by the people who operate each process every day: marketing, human resources, customer service, administration and finance, each with different purposes.

On top of that, there are three things that the spreadsheet does not solve well.

Reality changes faster than documents. A procedure says that the ID card is photographed with a machine at the store. The machine breaks down and the sales staff start taking a photo of it with their cell phone so as not to delay deliveries. That new processing has other risks, and it does not appear in any document.

Vendors also count. If a vendor processes data on behalf of the organization, the responsibility for its compliance remains with the organization. Its activities also go into the record.

Automated processes are processing activities. The welcome email that is sent automatically, the synchronization with a CRM or the weekly report that someone programmed years ago.

Building all of that with manual interviews and spreadsheets takes months. By the time it is finished, the first records have already changed.

What a software for doing the RAT should have

These are the capabilities worth reviewing when evaluating any tool:

1. Gathering with those who operate the processes, not only with the legal or compliance area.

2. Coverage of vendors and automated processes.

3. Lawful basis and risk level per activity, to know where to focus the compliance work.

4. Traceability: who described each activity and who validated it.

5. Updating without redoing the gathering every time a new process comes in.

6. Querying the record without exporting everything to Excel.

What options are there

There are three common paths.

The first is a consultancy with spreadsheets. It works for an initial snapshot, but the record ends up in a file that someone has to maintain.

The second is a global privacy platform. OneTrust, for example, digitizes the process: it offers data inventory and mapping that the organization's team completes. It is useful for coordinating a privacy program across many countries.

The third is automating the gathering. That is what Prisma IA does: instead of the privacy team filling out forms, the agent converses with each area and structures the record.

How Prisma IA works

1. Each employee converses with an AI agent in a guided interview.

2. The agent identifies the activities that person carries out with personal data and drafts the record for each one.

3. The data protection team reviews and approves each record.

4. The record is kept in a centralized library, with lawful basis, risk level and the trace of who described and who validated each activity.

5. From each activity, the platform helps identify risks and the controls that should be implemented.

The data protection team can also ask the record questions in natural language, such as which processing activities are based on consent or which concentrate the most risk.

Two cases: an automotive group and a financial group

A Chilean automotive group decided to build its record with its own team, without hiring an external consultancy. In 16 weeks, including a pilot, it completed 272 activities across 48 areas. It added a new group of areas every three weeks and audited what the agent was describing.

A Chilean financial group documented more than 800 processing activities across 26 divisions. Each processing activity took on average between 10 and 15 minutes.

Annual snapshot or living process?

New brands arrive, channels open, vendors are added. A record that is updated once a year describes how the organization worked months ago.

With Prisma IA, updating the record follows the same path as building it: when a new activity appears, the employee registers it by conversing with the agent.

A RAT is useful as long as it reflects how work is done today.

Frequently asked questions

What software is useful for doing the RAT in Chile?

There are global platforms that digitize the data inventory and tools that automate the gathering. Prisma IA, by Soyio, is made in Chile for Law 21.719 and builds the record with conversational interviews in each area.

How long does it take to do the RAT in a large organization?

It depends on the size and the pace that is defined. An automotive group completed 272 activities across 48 areas in 16 weeks, including a pilot. In a financial group, each processing activity took on average between 10 and 15 minutes.

Can the RAT be done without a consultancy?

Yes. A Chilean automotive group did it with its own team and Prisma IA. The data protection team reviews and approves what the agent drafts.

Who has to participate?

The people who operate the processes with personal data in each area. They know how work is done in practice, which is often different from what the procedure says.

Should vendors be included?

Yes. If a vendor processes data on behalf of the organization, the responsibility remains with the organization.

How often is the record updated?

Every time a process changes. That is why it is worth making updating it as simple as registering a new activity.