Recording Personal Data Processing Activities

Generating and Exporting Evidence Chains

• You can generate an evidence chain for an DI only when DI Status is Approved.
• You can export an evidence chain only when Evidence Chain Status is Approving or Approved.

1. Log in to the PCMC.
2. In the navigation pane, choose Record of Personal Data Processing Activities. The Personal Data Life Cycle page is displayed.
3. Locate the target DI and click Generate Evidence Chain in the Operation column. A success message will be displayed in the upper part of the page.
4. Click next to the DI in the Personal Data Business Name column to view the included evidence chains.
5. Locate the target evidence chain and click Edit in the Operation column. The Evidence Chain Editing page is displayed.
6. In the Data Inventory module:
   • If any DI is approved, Data Inventory is marked as Complete. You can view the DI information and approval records.
   • If no DI is approved, Data Inventory is marked as Missing. In this case, complete the DI approval on the DI Management page.
   • You can click Whether to Display in the upper right corner to show or hide the module content. If the toggle is turned off, the module will be hidden in the exported evidence chain.

   Click Save and Proceed to Next Step.

7. In the Risk Assessment module, to add a risk assessment report from the system, select System Selection under Add Risk Assessment Report. Then, click Select Report Version, select an assessment report version, and click Confirm. To upload a risk assessment report completed offline, select Offline Upload and click Add File to upload the report.
   • If there is an approved risk assessment report available and an offline risk assessment report has been uploaded, Risk Assessment is marked as Complete. You can view the DI information and approval records.
   • If there is no approved risk assessment report available or no offline risk assessment report has been uploaded, Risk Assessment is marked as Missing. In this case, complete the PIA/DPIA approval on the PIA/DPIA Management page.
   • You can click Whether to Display in the upper right corner to show or hide the module content. If the toggle is turned off, the module will be hidden in the exported evidence chain.

   Click Save and Proceed to Next Step.

8. In the Privacy Declaration module, to add a privacy statement from the system, select System Selection under Add Privacy Statement. Then, click Select Privacy Statement Version, select a privacy statement version, and click Confirm. To upload a privacy statement completed offline, select Offline Upload and click Add File to upload the offline privacy statement. Enter the privacy statement URL or attachment in the text box. The URL must start with http:// or https://.
   • If there is an approved privacy statement assessment report available and an offline privacy statement has been uploaded, Privacy Declaration is marked as Complete. You can view the DI information and approval records.
   • If there are no approved privacy statements available or the offline risk assessment report has not been uploaded, Privacy Declaration is marked as Missing. In this case, complete the privacy statement report approval on the Privacy Statement Management page.
   • You can click Whether to Display in the upper right corner to show or hide the module content. If the toggle is turned off, the module will be hidden in the exported evidence chain.

   Click Save and Proceed to Next Step.

9. In the Processing Purpose module, click Whether to Display in the upper right corner to show or hide the module content. If the toggle is turned off, the module will be hidden in the exported evidence chain.
   • Basic Information: It displays the basic DI information.
   • Third-Party Privacy Protection Assessment Report (Optional): Under Data Processing Agreement (DPA) and DPA Signature Record and Controller's Authorization Record for Processor to Engage Sub-Processors, click Add File to upload the required files, respectively.
   • Personal Data Usage and Retention: The data is automatically obtained from the DI. Paste the data deletion records upon expiration in the text box or click Add File to upload the required file. (This step is optional.)
   • Cross-border Transfer:
     1. Click Select Version, select a cross-border assessment version, and click Confirm.
     2. Paste the cross-border personal data transfer assessment report in the text box or click Add File to upload the required file. (This step is optional.)
     3. Click Select Version, select the approved DTA, and click Confirm.
     4. Paste the DTA and DTA signature in the text box or click Add File to upload the required file. (This step is optional.)
   • If there is any approved DI and approved cross-border transfer assessment and DTA, Processing Purpose is marked as Complete.
   • If there is no approved DI, or no approved cross-border transfer assessment or DTA is available, Processing Purpose is marked as Missing. In this case, complete the DI approval on the DI Management page, and complete other approvals on the Cross-border Transfer Assessment and Data Transfer Agreement Batch Signing page.

   Click Save and Proceed to Next Step.

10. After editing all steps, click Submit Audit.
11. After the approval is complete (see Approval Process for details) and Evidence Chain Status changes to Approved, choose More > Export Evidence Chain > Export All Information/Export Information with "Display Enabled" in the Operation column to export the evidence chain.
    • Export All Information: Export all evidence chain information.
    • Export Information with "Display Enabled": Export the evidence chain information for which Whether to Display is turned on.

12. Open the downloaded file to view the evidence chain information.

Viewing Records of Personal Data Processing Activities

1. Log in to the PCMC.
2. In the navigation pane, choose Record of Personal Data Processing Activities. The Personal Data Life Cycle page is displayed.
3. View the parameters. Table 1 explains them in detail.

   Table 1 Personal data lifecycle parameters

   Parameter	Description
   Personal Data Business Name	The name of the personal data business
   DI Version	The version of the DI
   DI Status	The status of the DI
   Evidence Chain Name/Evidence Chain Version	The name or version of the generated evidence chain
   Evidence Chain Status	The status that indicates whether the evidence chain is generated: Draft: Editing is available. Approving: Editing is unavailable.
   S Code	The corresponding S code
   Creation Time	The data creation time
   Creator	The creator of the data
   Update Time	The data update time
   Updated By	The person who updates the data
   Current Processor	The current approver for the evidence chain

4. Locate the target DI and click DI Details in the Operation column. The DI Details page is displayed.
5. Click next to the DI in the Personal Data Business Name column to view the included evidence chains. Click View details in the Operation column of an evidence chain to view its details.
6. View the data under Business Information, Processing Purpose, and Audit History Log.

Related Operations

Click next to the S code in the Personal Data Business Name column to view the included evidence chains.

• Choose More > Copy in the Operation column to copy an evidence chain.
• Choose More > Delete in the Operation column to delete an evidence chain.

Approval Process