In 05.1 Guidelines for Data Inventory and Processing Activities the Inventory of processing activities is mentioned a lot. Document 05.2 the Appendix Inventory of Processing activities mentions that this inventory is for Controllers:
1. Do we need a separate inventory for Processing activities for data of our clients (As Processor)? If so should we adapt this document or is there a separate document.
2. Does processing of employee data (of our own employees) also need to be added to the inventory?
1. The “Inventory of Processing Activities” has two separate sheets. The controller sheet is to be used to capture the processing activities where you act as a data controller and the processor sheet should be used for the processing activities where you act as a data processor. Art. 30 - Records of processing activities (https://advisera.com/eugdpracademy/gdpr/records-of-processing-activities/) requires that under certain circumstances both controller and processors keep these kind of records.
2. Processing activities related to your own employees such as recruitment, onboarding, payroll, time management etc. need to be captured in the “Inventory of Processing Activities” in the controller sheet.