A practical guide to PDPA records of processing activities for IT teams

It always starts with the same question

Whether the subject is the processing record, a data subject request or a breach notification, everything begins from the same question: what personal data does the organisation hold, and where? While that cannot be answered, a written policy cannot be enforced in practice.

• Work through the systems holding personal data, including mail attachments, file shares and exported reports.
• Do not overlook the invisible copies: backups, test environments, and systems that were retired but never switched off.
• Name an owner for each system so there is someone who can answer when the question is asked.

What the IT team has to provide

• Categories of data: What each system holds, and whether any of it is sensitive personal data.
• Who can reach it: User groups and their entitlements, including external providers with access.
• Retention: How long data is kept, and whether anything actually deletes it when that period ends.
• Security measures: The access control, encryption and access logging genuinely in place — not the ones that were planned.

External providers are in scope too

When personal data goes to an external provider for processing — cloud platforms, email services, analytics — responsibility does not travel with it. The IT team should know which providers can reach the data, where it is stored, and whether any of it is sent or transferred out of the country, which is governed by a notification of its own.

Make it something that survives the year

The common failure is not producing the first record; it is keeping it true twelve months later. What works is attaching the update to a process that already runs: make it a step in the approval for any new system or new provider, rather than an annual review project that keeps getting postponed.