How should changes to a personal data processing authorisation for an employee be made correctly?

ANSWER

There are two options for making changes to authorisations. The first is to amend the existing authorisation, i.e. by means of an amendment, e.g. Amendment No. 1 to the authorisation, changing only the job position. The second is to issue a new authorisation in place of the old one (the old one is revoked). Both options are permissible; however, if the controller decides on one of the two, it is recommended to continue using that same chosen option in order to maintain orderly documentation. It should also be remembered to update the data protection documentation itself, i.e. the register of authorised persons/list of authorised persons, if the controller maintains such a document as part of their documentation.