GDPR records

Three records UK GDPR expects every firm to keep. guardbook works out the deadlines. Go to Organisation, then GDPR.

​

Breach log

Log every personal data breach, whether you report it or not. UK GDPR requires a record of all of them. Choose Log a breach and record:

• a short title, for example “Survey report emailed to the wrong client”
• when you found out and when it happened
• what happened, what data was involved, and how many people were affected
• the risk to the people affected

As soon as you enter when you found out, guardbook shows the ICO deadline: 72 hours from that moment. A breach that is likely to result in a risk to people must be reported to the ICO by then. If it is likely to result in a high risk, you must also tell the people affected without undue delay. guardbook flags this. Then record whether you reported it to the ICO (and the reference), or why not, when the people affected were told, what you did to contain it and stop it happening again, who owns it, and when it was closed.

​

Data requests

When someone asks about their data, choose Log a request. Pick the type:

• subject access (a copy of their data)
• correct their data
• delete their data
• restrict use of their data
• object to use of their data
• data portability
• other

Record who asked and when. guardbook shows the due date: one calendar month from receipt, moved to the next working day if it lands on a weekend. For complex or numerous requests you can tick Extended by two months. You must tell the person within the first month, with the reason. When you finish, record the date and outcome: fulfilled, partly fulfilled, refused (with reasons given) or withdrawn.

​

Processing activities

Your record of processing activities lists what personal data the firm handles and why. Choose Add an activity for each one, for example client survey files, staff records or marketing emails. Record:

• why you process it and the lawful basis
• whose data it is and what data
• whether it includes special category data (such as health or ethnicity), and the extra condition you rely on
• who it is shared with, and whether it goes outside the UK
• how long you keep it and how it is kept secure
• any tool used, and when to review it next

​

Deadlines and reminders

Open breaches, open requests and review dates all appear on the compliance calendar and in the reminder emails.