CloudSignLab
Sign inStart free

Help centerRegisters and records

Keep your data protection registers

Record processing activities, handle data subject requests on time and log personal data breaches with the 72-hour deadline, as the GDPR asks.

Updated September 29, 2026

In this section: Registers and records

Data protection holds three GDPR registers. It contains personal data, so only owners and admins can open it. Open it from the organization menu.

Processing activities

Your record of processing activities (GDPR Art. 30). Each entry gets a number such as PA-3.

  • Name, Purpose and Legal basis: consent, contract, legal obligation, vital interests, public task or legitimate interests.
  • Whose data and Kinds of personal data, and whether special categories (health, biometrics, ...) are included.
  • Recipients, Processors (suppliers) and Transfers outside the EU/EEA and safeguards.
  • How long kept, Security measures, whether a data protection impact assessment is needed, a Review date, and the status (active or retired).

Start with HR, customers and your website.

Data subject requests

Requests from people about their data (DSR-n). Record the Right exercised (access, rectification, erasure, restriction, portability or objection), the Requester (keep it short: a name or a reference) and Received on.

  • The answer is due one month later; month ends are handled for you.
  • Tick the extension for complex or many requests: the deadline becomes three months.
  • Set the status (open, in progress, completed or rejected), who handles it, and notes.

Overdue requests are marked, and owners and admins get one reminder.

Breaches

Every personal data breach is logged (DB-n), even if you do not report it (Art. 33(5)).

  1. Enter Aware since and the Risk to people: unlikely a risk, risk or high risk.
  2. Describe what happened, the kinds of data, the people affected, likely consequences and measures taken.
  3. Link the Security incident if there is one: NIS2 and GDPR reports can both be due.
  4. Record when the authority was told and its reference, and when people were told. A high risk means telling the people affected (Art. 34).
  5. If you do not report, write down why.

With a risk, the authority must hear within 72 hours of awareness. The deadline is shown, and a reminder comes 24 hours before.

Privacy of the registers

The audit log records only the register and number, never personal data. Data protection is included from the Professional package.

See also