Why documentation is an obligation.
WHAT IT REQUIRES
Not only complying, but being able to show it.
WHY THAT CHANGED THINGS
Previously, a regulator had to demonstrate a failing; now you must demonstrate compliance.
WHAT THAT MEANS PRACTICALLY
Decisions must be recorded at the time.
WHAT TO RECORD FOR EVERY PROCESSING ACTIVITY
The purpose The lawful basis The data categories Recipients Transfers Retention Security measures
WHAT ELSE TO RECORD
Assessments you carried out Decisions not to do something, with reasoning Training delivered Incidents, including those not notified
WHY RECORD DECISIONS NOT TO ACT
Concluding an assessment was unnecessary is a decision requiring justification.
WHAT MAKES RECORDS CREDIBLE
Contemporaneous creation Consistency with practice Signs of genuine consideration
WHAT MAKES THEM WORTHLESS
Being written after an enquiry Describing practices nobody follows Templates with the previous organisation's details
WHAT TO ASSIGN
Ownership of each record.
WHAT TO SCHEDULE
Review, annually at minimum.
WHAT TO DO WHEN PRACTICE CHANGES
Update the record at the time.
WHY
Otherwise the documentation and reality diverge invisibly.
WHAT TO TEST
Whether you could produce it within days.
