◇ OpenCyber Academy
Bachelor's · Chapter 21 · English

Chapter 21 — Privacy and data protection: system models

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 21 — Privacy and data protection: system models

Lesson map

Lesson 21 published. Map, example, EX061.

flowchart TD
  N0["Learning outcomes"]
  N1["21.1 Processing as a system"]
  N2["21.2 Record of processing"]
  N3["21.3 Roles"]
  N4["21.4 Model checks"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX061"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["21.1 Processing as a system"]
  N2["21.2 Record of processing"]
  N3["21.3 Roles"]
  N4["21.4 Model checks"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX061"]

[Learning outcomes]
    |
    v
[21.1 Processing as a system]
    |
    v
[21.2 Record of processing]
    |
    v
[21.3 Roles]
    |
    v
[21.4 Model checks]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX061]

Learning outcomes

You will (1) model the trust's processing as a system; (2) build a record of processing activities; (3) identify controllers and processors.

21.1 Processing as a system

In the third year Elena models the trust's processing as a system of activities, each with a purpose, data categories, people affected, recipients and retention. Admissions, attendance, teaching, special educational needs support, safeguarding, catering and communications are separate activities. Modelling activities rather than systems helps her see that one system may serve several purposes, and that one purpose may use several systems. Purpose, she learns, is the organising concept that the law uses, so her model follows it. Admissions is one purpose.

21.2 Record of processing

Article 30 of the GDPR requires a record of processing activities. Elena builds one with a row per activity. For catering, the purpose is providing meals; data include names, dietary needs and free meal eligibility; recipients include the catering contractor; retention is the school year plus one. Building the record reveals gaps, such as no defined retention for communications. She presents the record to the data protection lead as a living document that should be updated whenever processing changes. It lists each purpose.

21.3 Roles

Elena identifies roles using EDPB Guidelines 07/2020. The trust is controller for its schools' processing. The catering contractor and most app vendors are processors acting on the trust's instructions. A local authority receiving census data is a separate controller with its own legal duties. She notes that roles matter because they determine who answers rights requests, who notifies breaches and what contracts are needed, and that the role depends on what an organisation actually does rather than on what a contract calls it.

21.4 Model checks

Elena checks the model against reality by asking staff to walk through a typical day. A teacher describes sending photographs to a parent messaging app not in the model. The app becomes a new row in the record, with a vetting review. She explains that models are useful only when checked against practice, and that conversations with staff reveal processing that no system diagram shows because it happens through informal tools chosen for convenience. She finds one class using a messaging app.

Worked example

Elena models seven processing activities, builds an Article 30 record, assigns controller and processor roles and adds an unrecorded messaging app found by walking through a teacher's day.

Synthetic case. Activities are synthetic; GDPR Article 30 and EDPB Guidelines 07/2020 are real.

Errors and limits

Records go stale quickly; tie updates to procurement and project processes.

Exercises

Synthesis

Chapter 21 models processing. Chapter 22 examines data and dependencies.

Continue studying — chapter 21 of 40

← Chapter 20 (draft) · Course chapter index · Chapter 22 (draft) →