Operational planning and control (8.1)
The criteria set during planning are applied day to day: a new processing activity goes through its assessment before it starts, and a new supplier receives no data without a contract. Outsourced processes are controlled as well.
Ongoing risk assessment and treatment (8.2 and 8.3)
The assessment is repeated at planned intervals and whenever there are significant changes: a new application, a transfer to another country, a merger. The results of every assessment and every treatment plan must be kept.
Where Annex A comes in
In practice, operation is where the controls live: the record of processing, impact assessments, handling of rights, contracts with processors. They are explained in the chapter devoted to Annex A.
What an auditor usually asks for
- A procedure for onboarding new processing activities with prior assessment
- Dated risk assessment results
- Treatment plans with their implementation status
- Control of external processes and suppliers
How to cover operation in Kimobox
- 1Set up the onboarding of a processing activity as a workflow with assessment and approval.
- 2Schedule the periodic risk review with due-date alerts.
- 3Oversee processors from the supplier portal.
No new processing activity starts until the workflow has taken it through its assessment.