A personal data processing authorization register is a document that records who in your company has access to data and within what scope. Without it, you cannot demonstrate GDPR compliance during an inspection by UODO. Below, you will find specific information on what the register should contain, how to maintain it and who is responsible for it.
Many business owners treat GDPR as a one-time obligation. Documents go into a binder and no one looks at them again. The rules, however, require ongoing monitoring. At our law firm, we help organizations achieve full GDPR compliance: we create and implement data-protection procedures, advise on audits and train staff. Among other things, we provide:
- compliance audits,
- preparation of personal data protection policies,
- implementation of records of processing activities,
- advice on entering into data-processing agreements.
What is a personal data processing authorization register for?
An authorization register is documentation that precisely identifies who in the organization has the right to process personal data and within what scope. Implementing a register allows you to:
- Control access: monitor who in the company can access personal data and within what scope.
- Meet the accountability principle: under Article 5(2) GDPR, you must be able to demonstrate who is authorized to process data. The register is your evidence.
- Prevent unauthorized processing: reduce the risk of access by unauthorized people.
- Strengthen data security: the register supports the implementation of technical and organizational measures required by the GDPR.
- Prepare for audits and inspections: the register is evidence that authorizations have been formally granted.
- Clarify responsibility: know who is responsible for which data and manage permissions more easily.
What should the authorization register contain?
The register should contain detailed information about every person authorized to process personal data. Typical entries include:
- Authorization number: a unique identifier for the authorization granted.
- Name of the authorized person: identification details of the employee or other authorized person.
- Position or department: information about the person’s workplace or role in the organization.
- Scope of authorization: a description of which personal data may be processed and for what purpose, such as employee or customer data.
- Date authorization was granted: the date the authorization was formally issued.
- Authorizing person or body: the person or body that granted the authorization, such as the Personal Data Controller or a department head.
- Date the authorization expires or is revoked: the date on which the authorization ceases to be valid.
- Signature of the authorized person: confirmation that the person received the authorization and became familiar with the data-protection rules.
- Signature of the person granting the authorization: confirmation that the permissions were formally granted.
What should you do with the authorization register day to day?
- Create and maintain it: keep the register up to date by entering new people authorized to process data.
- Update it: update the register whenever there is a change, including:
- granting new authorizations,
- changing the scope of authorizations,
- revoking authorizations, for example, when cooperation ends or a person’s position changes.
- Monitor compliance: check whether the register reflects the actual situation, for example, during internal audits.
- Make it available during an inspection: you can present the register to the supervisory authority, such as UODO, as evidence that GDPR requirements are met.
- Archive it: retain the register for the specified retention period, even after an authorization has been revoked.
- Secure it: the register contains information about authorized people and must be protected against access by unauthorized people.
Who must keep an authorization register?
Every data controller and every processor (a company that processes data on behalf of a controller) must keep a register. This applies to:
- private companies,
- public institutions,
- non-profit organizations,
- every entity that processes personal data.
The organization’s size does not matter. If you process personal data, this obligation applies to you too.
Example process for granting and revoking authorizations
- A supervisor or HR department submits a request to authorize a new employee.
- The data controller grants the authorization and enters the employee in the register.
- The employee confirms receipt of the authorization by signing the relevant document.
- If the employee’s duties change, the authorization is updated.
- When cooperation ends, the authorization is revoked and the register entry is updated.
How AI can support the personal data processing authorization register
Artificial intelligence can improve authorization management in four areas:
Automatically granting authorizations
AI can automatically assign authorizations based on an employee’s role and responsibilities in the organization. This makes the process faster and less prone to errors.
Monitoring authorizations
AI analyzes system logs and checks whether employees authorized to process data stay within the agreed access scope.
Managing the authorization register
AI helps store and update the authorization register, reducing the risk of outdated entries and keeping the register consistent with the actual situation.
Reporting and audits
AI tools generate reports on compliance with authorization and personal data access procedures. This makes internal and external audits easier.
Summary
A personal data processing authorization register is a tool for controlling and monitoring access to data. It helps you:
- demonstrate GDPR compliance during a UODO inspection,
- reduce the risk of personal data breaches,
- demonstrate compliance with the accountability principle.
Update the register regularly and monitor whether it reflects the actual situation.
If your company needs support managing the authorization register or other areas of data protection, get in touch with our law firm.
Q&A: managing a personal data processing authorization register
Who implements the authorization-register procedure?
The company’s management board or a designated person, such as a Data Protection Officer (DPO), HR department or IT department responsible for access management.
Where should the personal data processing authorization register be kept?
In a secure location, such as a document management system, access-register software or as a paper record in the responsible department, for example, HR or the data protection department.
How should access to the personal data processing authorization register be provided?
Only to authorized people, through electronic systems with access controls or as a paper record kept in a location protected against unauthorized access.
Who should maintain the register under this procedure?
- HR department: registers authorizations in connection with hiring and employees’ duties.
- Data Protection Officer (DPO): supervises whether the register meets legal requirements.
- IT department: supports registration of access to IT systems.
- Department managers: verify and approve the scope of authorizations for their employees.
