Data protection registers

Illizeo keeps five data protection registers: retention periods, data breaches, data subject requests, impact assessments, and subprocessors and transfers. This article explains how to keep each of them and what the server checks. It is for the data protection officer and administrators.

Before you start #

• The five registers are tiles of Settings › Manage Illizeo: Data Retention, Data Breaches, Data Subject Requests, Impact Assessments and Subprocessors and Transfers.
• The permissions sit in the “Data privacy (GDPR)” menu of the role matrix (see Permissions & roles): “Retention policies — Configure”, “Data breach management”, “Data subject request register” and “Impact assessment (DPIA)”, which also covers transfers. The Access level lets you read (and export requests), the Execute level lets you write. Validating an impact assessment and deciding a transfer assessment require the Admin level.
• By default, only the Administrator role holds these permissions.
• These registers send no email or reminder: deadlines are shown on screen. Every action is recorded in the GDPR audit log (see Governance & security).

Data retention #

1. Open Data Retention and read the Legal disclaimer. Click I have read and accept: without this acceptance, which is personal and specific to each version, no duration can be changed.
2. Each jurisdiction has its card (FRA, CHE…), with the Data class, Bound, Legal value, Current, Anchor, Legal basis and Action columns.
3. To change a duration, click Edit, enter the value and unit, then Save. A duration below the legal floor or above the legal ceiling is blocked.
4. To add a country, choose it under Add a country from the Illizeo referential, then click Add from referential. All the referential’s classes are added; your existing durations are never overwritten.
5. For a country missing from the referential, open Add a class of your own (Add a country): Country, Data class, Bound, Duration, Anchor and Legal basis, then Add country. These lines show “added by you”; you alone are responsible for them, and only they can be deleted.

Illizeo cites a statute, with its bounds, for Belgium, Switzerland, Germany and France; elsewhere, a line may have no bound. What the durations trigger:

• every night, Illizeo deletes expired data for clock-in GPS locations, shift history, office presence and visitors, project client contacts, annualised working time and the recalculation journal, following the rule of the company’s country (of the site, for Flex Office);
• HR classes (payroll, contract, personal data, health, pension) are not deleted by age: their durations decide what is kept anonymised or erased when an employee’s data is erased;
• in Canada, a rule stays “to be confirmed by the controller” and purges nothing until it is confirmed in Edit.

Data breaches #

1. Open Data Breaches and click Record a breach.
2. Enter Discovered on (the deadline runs from discovery, not from the incident), Occurred on (if known), the Jurisdiction concerned, the Nature (Confidentiality, Integrity or Availability) and the Description of the facts, then Record. The entry gets a VIO-year-number reference; its nature and description can no longer change.
3. Open the entry and complete People affected, Records affected, Data categories, Likely consequences and Measures taken. Under Notification decision, tick The authority was notified and name the Authority notified, or enter a Reason for not notifying. Click Save analysis.
4. Click Close entry. As long as something is missing, closing is refused and the screen lists what is missing.

The deadline depends on the jurisdiction’s regime: 72 hours under the GDPR, the UK GDPR and Indian law; 30 days of assessment in Australia; “without undue delay”, with no fixed duration, in Switzerland, Canada, Quebec or Brazil; “Regime not qualified” for a country with no known regime. The countdown stops once the authority is notified or a reason is entered. In Canada, a harm assessment and notice to individuals are added. A closed entry can no longer be changed, and no entry can be deleted.

Data subject requests #

1. Open Data Subject Requests and click Record a request.
2. Enter Received on (the deadline runs from receipt), the Right exercised, the Channel, the Requester (employee) or, for a person without a record, the Requester name, the Person’s regime, the Subject of the request and any Fees announced (if any). Click Record.
3. To extend, open the request, Extend the deadline block: New deadline, Notified to the person on date and Reason for the extension, then Extend. The extension is single, capped, and must be announced before the initial deadline.
4. To finish, Close the request block: outcome Fulfilled, Partly fulfilled or Refused (reason required when refusing), answer date, then Close. A late answer stays recorded as late.

The deadline follows the person’s regime: one month in the European Union and the UK (extension of two months at most), 30 days in Switzerland, Canada and Quebec (no extension in Quebec), 45 days in Alberta. In Canada, no answer within the deadline counts as a refusal: the line says so. Export the register produces a CSV file, closed requests included. A recorded request can no longer be corrected.

Impact assessments #

1. Open Impact Assessments, enter the title of the processing and click New assessment. The title cannot change afterwards.
2. Complete Description of the processing, Purposes, Data categories, Data subjects, Necessity and proportionality, Risks to rights and freedoms, Planned measures, DPO’s opinion, Residual risk (after measures) and Next review, then click Save.
3. Click Submit for review.
4. At the Admin level, click Validate. Validation covers the saved content: save first. It is refused while the description, purposes, necessity, risks, measures or residual risk are missing, and the DPO’s opinion if the residual risk is high. Without a review date, Illizeo sets it one year ahead.

Saving a change to the content of a validated assessment sets it back to To revise and removes its validation. The counters track assessments that are validated, to revise, overdue for review and subject to prior consultation. Only a draft can be deleted, without a confirmation prompt.

Subprocessors and transfers #

• The page lists the destinations of your data: Illizeo and its subprocessors, as named on the published page whose link and version are given at the top. Services that are always used are ticked; optional services are ticked when Illizeo detects them in your configuration, otherwise tick In use yourself.
• Add your own recipients (bank, payroll provider…) with their Country and Draft the PIA.
• For a transfer outside Quebec, Law 25 requires a privacy impact assessment (PIA). Draft the PIA opens a draft: destination country, four factors, conclusion and, if protection is adequate, a written agreement. Save keeps the draft; Decide (Admin level) saves it and then freezes it. A decided assessment can no longer be changed: New version opens another.
• The “PIA missing” badge only appears if your company or one of your offices is in Quebec. The register documents transfers; it blocks no processing.

Good to know #

• The retention referential, the deadline regimes and the subprocessor list are maintained by Illizeo; a correction to the referential does not change the durations already in place in your workspace.
• The registers do not replace exporting or erasing a person’s data: they keep track of it and of its deadline.
• Some confirmation messages from these registers, and the published subprocessor details, are shown in French.