How should logs be recorded in the register of processing activities (ROPA)?
ANSWER
Should the decision be made to disclose system logs as a separate category of data within existing processing categories, the following fields of the ROPA must be completed:
- purposes of processing,
- categories of recipients to whom personal data have been disclosed (where additional recipients arise),
- transfer of data to a third country (where data transfers outside the EEA take place),
- data deletion periods.
If log processing is established as a separate category, all information fields referred to in Art. 30(1) GDPR must be completed.
