If an employee changes department within the employer's organisation but remains with the same entity and the categories of personal data processed do not change, must the employee's GDPR documentation be updated, e.g. the authorisation to process personal data?

ANSWER

An authorisation to process personal data should be changed only when there is a change in the scope for which it was granted — if the authorisation specifies the job position and it changes, a new authorisation should be issued or the existing one amended; the authorisation should also be changed if the scope of data the employee may process changes or other information contained in the authorisation itself changes.

If the authorisations issued do not specify employees' job positions and the scope of data to be processed does not change, there is no need to change them.