Create or update a processing activity

Manually create a processing activity or update a processing activity that is automatically created out of a privacy screening assessment. You can also update a processing activity that is created from an entity record. When you update a processing activity, you can fill in the relevant details about the personal data that is being processed.

Before you begin

Role required: sn_privacy.analyst (who owns the processing activity) or sn_privacy.manager

About this task

You can create a processing activity in two ways:

• Manually create a processing activity for a business application or process that handles personal data.
• Update a processing activity that was automatically created when a privacy screening assessment determined that personal data is being processed. Screening assessments include automation rules that create processing activities based on specific responses. To configure automation in your assessment template, refer to Post-assessment automations.

Procedure

1. Navigate to one of the following.

   Action	Procedure
   To create a new processing activity	Navigate to All > Privacy Management > Processing activities > All processing activities. Click New.
   To update a processing activity	Navigate to All > Privacy Management > Privacy Workspace > List > My items > Processing activities. Open the processing activity that you want to update.

2. On the form, fill in the fields.

   Table 1. New processing activity form

   Field	Description
   Name	Name of the processing activity.
   Processing activity purpose	Business justification or reason for using an application or a process that stores personal data.
   Number	Number of the processing activity. This field is automatically set.
   Privacy analyst	Analyst responsible for the processing activity.
   Business unit	Business unit of the processing activity.
   Department	Department of the processing activity.
   Processing activity type	Context of the processing activity such as a business application or a business process.
   Entity	Entity of the processing activity.
   Applies to record	Reference record used to create the processing activity record.
   Owned by	Owner of the processing activity.
   Data processing role	Defines if a processing activity is a data controller or a data processor.
   Processing activity status	Status of the processing activity. The choices are as follows: Implementing In Production Pilot Retired Under Evaluation
   Processing activity category	Category to which the processing activity belongs for example, customer care, finance, and so on.
   Compliance score	Privacy compliance score calculated based on all the controls mapped to this processing activity.
   Process owner	Any user, with the sn_privacy.business_user role, from the list of key stakeholders who has the editing privileges for the processing activity. Note: The user selected in this field can update the this field and select a new process owner. Updating this field is only possible when the processing activity is in the Discover or Review state.
   Data subject
   Data storage type	Format in which the personal information is stored. The choices are as follows: Digital Paper Both
   Data storage locations	Physical location of where the personal information is stored.
   Data retention period (in days)	Number of days for which personal information must be retained.
   Data subject type	User type related to the personal information that is being used and processed. The choices are as follows: Customers Employees Others
   Data subject range	Range of users for whom the personal information is being processed.
   Contains special category data?	This field is automatically set to either Yes or No. If any information object associated with the processing activity is classified as special category data, then this field is automatically set to Yes.
   Obtain special category data?	Does this processing activity process any special category data such as racial, ethnic, political information? The choices are as follows: Yes No
   Activity
   Additional comments	Additional information about the processing activity.
   Work notes	Internal notes not visible to the external people.

3. Click Save.

What to do next

Send a privacy assessment to a processing activity owner to collect more information on why and how the processing activity is using personal information. For more information, see Send a privacy assessment from a processing activity.