Which Processes Should You Document?

You don’t have to figure out what to document on your own

The GDPR requires you to record which personal data you process and why. That sounds like a huge task, but it’s manageable. GDPRWise does the heavy lifting: based on your sector and business type, the platform automatically suggests a list of relevant processing activities. You just confirm what you actually do, adjust where needed, and add any processes that are missing.

Three dossiers, three perspectives

GDPRWise divides your processing activities across three dossiers. Each dossier looks at your data processing from a different angle:

Customer dossier

Everything related to personal data of your customers and prospects:

• Quotes and invoices - names, addresses, VAT numbers, payment details
• CRM and customer management - contact details, communication history, notes
• Newsletters and marketing - email addresses, preferences, open and click behaviour
• Customer service - tickets, complaints, chat conversations
• Website and analytics - IP addresses, cookie data, form submissions

Employee dossier

Data about your employees, applicants, and any freelancers:

• Payroll - bank details, payslips, tax information
• HR management - employment contracts, evaluations, sick leave
• Recruitment - CVs, cover letters, assessment results
• Access management - login credentials, badges, time registration
• Internal communication - email, internal messages, team chats

Third-party dossier

All parties outside your business with whom you share data:

• Accountant - financial data of customers and employees
• Software vendors - CRM, email tool, cloud storage, analytics
• External service providers - lawyer, insurer, occupational health service
• Social media and advertising - data shared via pixels and integrations

How does it work in practice?

When you open a dossier in GDPRWise, you immediately see a list of suggested processes typical for your sector. A hospitality business gets different suggestions than an accounting firm or an online shop.

For each process, you fill in:

• Which data you process
• Why you do it (the purpose)
• The legal basis
• How long you retain the data

GDPRWise helps you at every step with example answers and explanations. No legal knowledge required.

Practical tips to get started

Start with what you know. Most business owners begin with the customer dossier, because they know it best. Complete that dossier before moving on to the next.

Open your actual tools. Log in to your CRM, accounting software, and email tool. Check which data is actually stored there. That gives you a much better picture than trying to recall everything from memory.

Don’t try to do everything at once. You can save a dossier and come back later. Plan two or three short sessions instead of one long afternoon. After the first session, you’ll have the rhythm and it gets faster.

Not sure if a process belongs? Include it. It’s better to document one process too many than one too few. You can always remove it later.