---
title: Data protection registers
description: Keep your retention periods, breach register, data subject requests, impact assessments and the register of subprocessors and transfers.
url: "https://illizeo.com/en/centre-aide/security-data-protection-registers/"
updated: "2026-11-05"
category: "Platform / Security & compliance"
---

# Data protection registers

Illizeo keeps five data protection registers: retention periods, data breaches, data subject requests, impact assessments, and subprocessors and transfers. This article explains how to keep each of them and what the server checks. It is for the data protection officer and administrators.

## Before you start

- The five registers are tiles of **Settings › Manage Illizeo**: **Data Retention**, **Data Breaches**, **Data Subject Requests**, **Impact Assessments** and **Subprocessors and Transfers**.
- The permissions sit in the "Data privacy (GDPR)" menu of the role matrix (see [Permissions & roles](https://illizeo.com/en/docs-category/platform-en/platform-roles-permissions/)): "Retention policies — Configure", "Data breach management", "Data subject request register" and "Impact assessment (DPIA)", which also covers transfers. The **Access** level lets you read (and export requests), the **Execute** level lets you write. Validating an impact assessment and deciding a transfer assessment require the **Admin** level.
- By default, only the Administrator role holds these permissions.
- These registers send no email or reminder: deadlines are shown on screen. Every action is recorded in the GDPR audit log (see [Governance & security](https://illizeo.com/en/docs-category/platform-en/platform-governance-security/)).

## Data retention

1. Open **Data Retention** and read the **Legal disclaimer**. Click **I have read and accept**: without this acceptance, which is personal and specific to each version, no duration can be changed.
2. Each jurisdiction has its card (FRA, CHE…), with the Data class, Bound, Legal value, Current, Anchor, Legal basis and Action columns.
3. To change a duration, click **Edit**, enter the value and unit, then **Save**. A duration below the legal floor or above the legal ceiling is blocked.
4. To add a country, choose it under **Add a country from the Illizeo referential**, then click **Add from referential**. All the referential's classes are added; your existing durations are never overwritten.
5. For a country missing from the referential, open **Add a class of your own** (**Add a country**): **Country**, **Data class**, **Bound**, **Duration**, **Anchor** and **Legal basis**, then **Add country**. These lines show "added by you"; you alone are responsible for them, and only they can be deleted.

![The Data Retention page: legal disclaimer with the I have read and accept button, the Add a country from the Illizeo referential card and the Add a class of your own card](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-data-protection-registers-01.en_.png?resize=800%2C433&quality=80&ssl=1)
Settings › Manage Illizeo › Data Retention.

Illizeo cites a statute, with its bounds, for Belgium, Switzerland, Germany and France; elsewhere, a line may have no bound. What the durations trigger:

- every night, Illizeo deletes expired data for clock-in GPS locations, shift history, office presence and visitors, project client contacts, annualised working time and the recalculation journal, following the rule of the company's country (of the site, for Flex Office);
- HR classes (payroll, contract, personal data, health, pension) are not deleted by age: their durations decide what is kept anonymised or erased when an employee's data is erased;
- in Canada, a rule stays "to be confirmed by the controller" and purges nothing until it is confirmed in **Edit**.

## Data breaches

1. Open **Data Breaches** and click **Record a breach**.
2. Enter **Discovered on** (the deadline runs from discovery, not from the incident), **Occurred on (if known)**, the **Jurisdiction concerned**, the **Nature** (**Confidentiality**, **Integrity** or **Availability**) and the **Description of the facts**, then **Record**. The entry gets a VIO-year-number reference; its nature and description can no longer change.
3. Open the entry and complete **People affected**, **Records affected**, **Data categories**, **Likely consequences** and **Measures taken**. Under **Notification decision**, tick **The authority was notified** and name the **Authority notified**, or enter a **Reason for not notifying**. Click **Save analysis**.
4. Click **Close entry**. As long as something is missing, closing is refused and the screen lists what is missing.

![The data breach register with its counters and the New entry form open: Discovered on, Occurred on, Jurisdiction concerned, Nature and Description of the facts](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-data-protection-registers-02.en_.png?resize=800%2C500&quality=80&ssl=1)
Data Breaches › Record a breach.

The deadline depends on the jurisdiction's regime: 72 hours under the GDPR, the UK GDPR and Indian law; 30 days of assessment in Australia; "without undue delay", with no fixed duration, in Switzerland, Canada, Quebec or Brazil; "Regime not qualified" for a country with no known regime. The countdown stops once the authority is notified or a reason is entered. In Canada, a harm assessment and notice to individuals are added. A closed entry can no longer be changed, and no entry can be deleted.

## Data subject requests

1. Open **Data Subject Requests** and click **Record a request**.
2. Enter **Received on** (the deadline runs from receipt), the **Right exercised**, the **Channel**, the **Requester (employee)** or, for a person without a record, the **Requester name**, the **Person's regime**, the **Subject of the request** and any **Fees announced (if any)**. Click **Record**.
3. To extend, open the request, **Extend the deadline** block: **New deadline**, **Notified to the person on** date and **Reason for the extension**, then **Extend**. The extension is single, capped, and must be announced before the initial deadline.
4. To finish, **Close the request** block: outcome **Fulfilled**, **Partly fulfilled** or **Refused** (reason required when refusing), answer date, then **Close**. A late answer stays recorded as late.

![The data subject request register with its counters and the New request form open: Received on, Right exercised, Channel, Requester, Person's regime, Subject of the request and fees](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-data-protection-registers-03.en_.png?resize=800%2C500&quality=80&ssl=1)
Data Subject Requests › Record a request.

The deadline follows the person's regime: one month in the European Union and the UK (extension of two months at most), 30 days in Switzerland, Canada and Quebec (no extension in Quebec), 45 days in Alberta. In Canada, no answer within the deadline counts as a refusal: the line says so. **Export the register** produces a CSV file, closed requests included. A recorded request can no longer be corrected.

## Impact assessments

1. Open **Impact Assessments**, enter the title of the processing and click **New assessment**. The title cannot change afterwards.
2. Complete **Description of the processing**, **Purposes**, **Data categories**, **Data subjects**, **Necessity and proportionality**, **Risks to rights and freedoms**, **Planned measures**, **DPO's opinion**, **Residual risk (after measures)** and **Next review**, then click **Save**.
3. Click **Submit for review**.
4. At the Admin level, click **Validate**. Validation covers the saved content: save first. It is refused while the description, purposes, necessity, risks, measures or residual risk are missing, and the DPO's opinion if the residual risk is high. Without a review date, Illizeo sets it one year ahead.

Saving a change to the content of a validated assessment sets it back to **To revise** and removes its validation. The counters track assessments that are validated, to revise, overdue for review and subject to prior consultation. Only a draft can be deleted, without a confirmation prompt.

## Subprocessors and transfers

- The page lists the destinations of your data: Illizeo and its subprocessors, as named on the published page whose link and version are given at the top. Services that are always used are ticked; optional services are ticked when Illizeo detects them in your configuration, otherwise tick **In use** yourself.
- Add your own recipients (bank, payroll provider…) with their **Country** and **Draft the PIA**.
- For a transfer outside Quebec, Law 25 requires a privacy impact assessment (PIA). **Draft the PIA** opens a draft: destination country, four factors, conclusion and, if protection is adequate, a written agreement. **Save** keeps the draft; **Decide** (Admin level) saves it and then freezes it. A decided assessment can no longer be changed: **New version** opens another.
- The "PIA missing" badge only appears if your company or one of your offices is in Quebec. The register documents transfers; it blocks no processing.

![The Subprocessors and Transfers page: link to the published page, Quebec banner and list of destinations with their category, region and safeguards, their qualification and the Draft the PIA button](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-data-protection-registers-04.en_.png?resize=800%2C500&quality=80&ssl=1)
Settings › Manage Illizeo › Subprocessors and Transfers.

## Good to know

- The retention referential, the deadline regimes and the subprocessor list are maintained by Illizeo; a correction to the referential does not change the durations already in place in your workspace.
- The registers do not replace exporting or erasing a person's data: they keep track of it and of its deadline.
- Some confirmation messages from these registers, and the published subprocessor details, are shown in French.

### *Similaire*