Keep the record of processing activities
Information governance, information security and data protection officer: Keep the record of processing activities. Starts when: A processing activity starts or changes. Steps: Record purpose, lawful basis, categories, recipients, retention and security; Review annually. Done when: Every processing activity has a current entry with a review date. Rules that apply: UK GDPR Article 30.