Section 8 · Section 11
Records of processing for DPDP
A processing record shows what personal data you hold, why and where. TruePrivacy keeps it in step with what discovery finds.
Sample workspace
Processing activities
- Loan underwriting4 systems
- Customer support2 systems
- Collections3 systems
- Marketing emails1 system
Latest sync
- Synced from discovery scan
- Retention rule set on Collections
- Export for auditor
Short answer
A Data Fiduciary is responsible for the processing it does, including processing by its Data Processors (s.8(1)), and must give a Data Principal a summary of their personal data, its processing and who it was shared with on request (s.11). Significant Data Fiduciaries also carry out periodic DPIAs and data audits (s.10(2)(c), Rule 13). TruePrivacy keeps records of processing activities and a data map, synced from discovery and exportable.
What the processing record does
A record of processing answers three questions: what personal data you hold, why you hold it and where it sits. Notices, retention, rights requests and breach response all start from those answers. TruePrivacy builds the record from what discovery finds, so it starts from your systems rather than a blank sheet.
A register of your processing activities.
Activities sync from what data discovery finds in connected systems.
See which systems hold personal data.
Export the record for auditors and counsel.
Set retention rules against a processing activity, with an approval step if you need one.
How the record stays current
- 01Scan your systems
Connect systems and let discovery list the personal data they hold. AI suggests a classification for each finding and a person confirms or rejects it.
- 02Review activities
Processing activities sync from discovery. Review them with the teams that own each one, and check which vendors process data for each activity.
- 03Set retention
Add retention rules per activity.
- 04Export when asked
Export the record for an auditor, a DPIA, or to prepare an access summary. Under s.11 that summary also covers who the data was shared with, so check your vendor list too.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Be responsible for processing, including processing by your Data Processors | s.8(1) | A register of processing activities and a data map |
| Summary of personal data and processing, and who it was shared with | s.11 | A record to prepare the summary from |
| Periodic DPIA and data audit (SDFs) | s.10(2)(c), Rule 13 | An exportable record as input to the DPIA and data audit |
| Erase when the purpose is no longer served | s.8(7) | Retention rules per processing activity |
| Intimate a breach, with its nature and extent | s.8(6), Rule 7 | A data map to work out what a breached system held |
| Engage processors only under a valid contract | s.8(2) | Use alongside vendor records and contract (DPA) tracking |
A record, not a legal opinion
TruePrivacy keeps the record; your team confirms what each activity does and why. Synced activities reflect the systems you have connected, so check for processing in systems you have not connected, and on laptops through the DSPM endpoint agent.
If you are notified as a Significant Data Fiduciary, the record becomes an input to the yearly DPIA and data audit under Rule 13. The record-keeping guide covers what to keep and for how long.
Works with
Scans that find personal data and feed the record.
Retention and erasureRules per processing activity, with an executions log.
SDF: DPIA, DPO and data auditYearly DPIA and data audit clocks for Significant Data Fiduciaries.
Vendors and processorsVendor records, assessments and contract (DPA) tracking.
How does a record of processing help with access requests?
Section 11 gives a Data Principal the right to a summary of their personal data and its processing, and the identities of other fiduciaries and processors it was shared with. A current record makes that summary quicker to prepare.
Is the record kept up to date automatically?
Processing activities sync from discovery, so they follow what scans find in connected systems. Your team still reviews them.
Can I export the record?
Yes. The record of processing is exportable, and the audit trail exports as CSV.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin