{"text_format":"1","workbook":"xlsx","n_sheets":5,"sheets":["Sheet2","GDPR- The Journey - WHY","Record of Processing Activities","Guidance","Example Listings"],"not_rendered":{"charts":0,"images":7,"macros":1,"external_links":0,"defined_names":2,"comments":1,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Sheet2","index":0,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":true,"merged":[]}

{"sheet":"GDPR- The Journey - WHY","index":1,"n_rows":6,"n_cols":16,"rows_kept":6,"cut":false,"hidden":false,"merged":[]}
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null," GENERAL DATA PROCTECTION REGULATION (GDPR)"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"  Legal requirement on all Organisations."]

{"sheet":"Record of Processing Activities","index":2,"n_rows":21,"n_cols":16,"rows_kept":21,"cut":false,"hidden":false,"merged":[[1,0,8,1],[1,2,1,9],[2,8,2,9],[9,1,9,12],[9,13,9,15]]}
[]
[null,null,"Controller"]
[null,null,"Location",null,"Department ",null,"Relevant Manager",null,"Completed by (if different to relevant manager)"]
[null,null,"Name",null,"Name",null,"Name",null,"Name"]
[null,null,"Address",null,"Address",null,"Address",null,"Grade"]
[null,null,"Email",null,"Telephone",null,"Email",null,"Email"]
[null,null,"Telephone",null,null,null,"Telephone",null,"Telephone"]
[]
[]
[]
[null,"Ref. No.","Purpose of processing\n","Other (please state)","Categories of\n DATA SUBJECTS\n","Categories of \nPERSONAL DATA\n","Other (please state)","DATA SHARING\n - with whom","Other (please state)","LEGAL BASSIS\n for processing","Retention Period","Location of personal data","Names of third countries that personal data are transferred to (if applicable)","Safeguards for Third Country Transfers","General description of technical and organisational security measures (if possible)","Name and contact details of joint controller (if applicable)"]
[]
[]
[]
[]
[]
[null,null,"Task management,\nSecurity",null,"Current Employee,\nSupplier","Identification information assigned by government institutions,\nFinancial transactions,\nPension plan details"]
[]
[null,null,"Task management,\nVendor management",null,"Current Employee,\nPatient/Service User","Identification information assigned by government institutions,\nInsurance policy details"]
[]
[null,null,"Personnel management,\nClaims management",null,"Supplier,\nPast Employee","Identification information assigned by government institutions,\nPension plan details"]

{"sheet":"Guidance","index":3,"n_rows":22,"n_cols":5,"rows_kept":22,"cut":false,"hidden":false,"merged":[[17,3,17,4],[18,3,18,4],[19,3,19,4],[20,3,20,4],[21,3,21,4],[1,1,1,4],[2,1,2,4],[8,3,8,4],[10,3,10,4],[12,3,12,4],[11,3,11,4],[15,3,15,4],[13,3,13,4],[14,3,14,4],[3,1,3,4],[4,1,4,4],[5,1,5,4],[6,1,6,4],[7,1,7,4],[9,3,9,4]]}
[]
[null,"Notes"]
[null,"Use this template to document the processing activities you undertake as a controller."]
[null,"Instructions"]
[null,"1.   Complete your location/department name and contact details "]
[null,"2.   Complete the relevant managers name"]
[null,"3.   Document your processing activities and working from left to right. Where necessary select multiple items for each processing activity in order to be as granular as possible. Where you select 'Other' as an option please provide detail in the columns provided."]
[null,"Guidance"]
[null,"Category","Completed By:","Description"]
[null,"Ref No.","Controller","Enter a reference number for each entry. The first records will have Ref No. 1."]
[null,"Purpose of Processing","Controller","Why is data being processed? See example listings tab for more information, include all that apply."]
[null,"Other (Please State)","Controller","If 'other (please specify)' is selected in the previous drop down for the purpose of processing for example, then please state the other purpose of processing. "]
[null,"Categories of Data Subjects","Controller","Which categories of data subjects does the data relate to? E.g. Patients, service users, staff (past, present, future) etc. include all that apply."]
[null,"Categories of Personal Data","Controller","Which categories of personal data are being processed? See example listings  tab for more details and select all that apply."]
[null,"Who the data is shared with","Controller","Which categories of recepients are being processed? See example listings  tab for more details and select all that apply."]
[null,"Legal basis for processing ","Controller","What is the legal basis for processing the data (GDPR Article 6)"]
[null,"Retention Period","Controller","What is the retention period of the data? For more information see the HSE records retention policy available here: ","Record Retention Policy"]
[null,"Location of Personal Data","Controller","Where is the personal data stored and from where can it be accessed?"]
[null,"Names of third countries or international organisations that personal data are transferred to (if applicable)","Controller","What countries or international organisation is the data being transferred to? Countries inside the EEA do not need specific safeguards for transfer. "]
[null,"Safeguards for Third Country Transfers","Controller/ DDPO","What legal safeguards are in place for transfers outside of the EEA? See example listings  tab for more details. If further guidance is needed regarding safeguards for transfers you can contact your Deputy Data Protection Officer (DDPO)."]
[null,"General description of technical and organisational security measures (if possible)","Controller/ IT/ DDPO","Give a general description of the technical and organisational security measures that are in place. This information can be found on the Privacy Impact Assessment Form for the processing activity. For further details contact IT support and your DDPO."]
[null,"Name and contact details of joint controller (if applicable)","Controller/ Procurement ","If the processing operation has more than one controller, the joint controllers' details need to be entered. Central procurement can be contacted for details on contracts."]

{"sheet":"Example Listings","index":4,"n_rows":99,"n_cols":3,"rows_kept":99,"cut":false,"hidden":false,"merged":[[1,1,1,2],[3,1,3,2],[5,1,5,2],[2,1,2,2],[91,1,91,2],[50,1,50,2],[51,1,51,2],[56,1,56,2],[57,1,57,2],[58,1,58,2],[59,1,59,2],[60,1,60,2],[61,1,61,2],[62,1,62,2],[63,1,63,2],[64,1,64,2],[84,1,84,2],[73,1,73,2],[74,1,74,2],[75,1,75,2],[76,1,76,2],[83,1,83,2],[27,1,27,2],[65,1,65,2],[66,1,66,2],[67,1,67,2],[69,1,69,2],[49,1,49,2]]}
[]
[null,"This tab provides several lists that may be of use to you as you fill out the Records of Processing Activities Tab. "]
[null,"These lists are only indicative, both regarding the level of detail and their completeness. It is the controller’s responsibility to provide more detailed information regarding the processing activity, if necessary."]
[null,"Click on the ‘+’ next to the list name to expand the list."]
[]
[null,"Purposes of Processing"]
[null,"Purpose","Explanation"]
[null,"HR","Recruitment and selection of employees and intermediaries (brokers, independent representatives, etc.). Staff records,  Payroll administration, remunerations, commissions, and wages. Application of social legislation."]
[null,"Personnel management","Evaluation and management of employees and intermediaries. Planning of training and career."]
[null,"Task management","Planning and management of tasks, work loads and performance."]
[null,"Workplace monitoring","Monitoring the professional activities in the workplace via CCTV or IT systems, such as monitoring of email, Internet usage, telephones, etc."]
[null,"Claims management","Management of claims, including repayment of monies owed."]
[null,"Vendor management","Vendor administration. Management of orders received and payment of vendors. Prospecting possible vendors and their evaluation."]
[null,"Security","Data processing to ensure the safety of people or goods. "]
[null,"Dispute management","The management by natural persons, private bodies or public authorities of their own disputes."]
[null,"Applications for Services","Applications made by data subjects to access services"]
[null,"Research","Data being used for research purposes"]
[null,"Audit","Data concerning systematic reviews or evaluation of services"]
[null,"FOI/DP","Freedom of information or data protection "]
[null,"Complaints ","General complaints "]
[null,"Patient care","The diagnosis and paramedical treatment of patient, including the evaluation of the provided and yet to be provided care for the purpose of improving the quality of care offered to patients."]
[null,"Medical coding","Tracking of in-patient care and treatment for the purpose of invoicing."]
[null,"Patient records","Registering medical and in-patient information for management purposes."]
[null,"Registering risk groups","Identifying and monitoring persons with elevated medical risks."]
[null,"PQ's and/or  Reps"," Files in relation to Parlimentary Questions, or Representations from holder of Public Office"]
[null,"Medication inventory management","Data processing related to the prescription and delivery of medication."]
[null,"Other purpose (please specify)","To be described by the controller."]
[null,"Categories of Personal Data"]
[null,"Category of Data","Explanation"]
[null,"Personally Identifiable Information","Name, title, address (work and home), former addresses, telephone number (work and home), IDs assigned by the controller, email address. "]
[null,"Medical Card Number"]
[null,"Identification information assigned by government institutions","ID card number, passport number, drivers license number, license plate number, etc."]
[null,"Financial identification data","ID numbers, bank account numbers, credit or debit card numbers, secret codes."]
[null,"Financial means","Income, possessions, investments, total income, professional income, savings, start and end dates of investments, investment income, debts owed on assets."]
[null,"Vetting Data","e.g Garda vetting "]
[null,"Insurance policy details","Nature of the insurance policy, details regarding the covered risks, insured amounts, insured period, termination date, payments made, received, or missed, status of the agreement."]
[null,"Pension plan details","Effective date of the pension plan, nature of the plan, termination date of the plan, received and made payments, options, beneficiaries."]
[null,"Financial transactions","Amounts paid and payable by the data subject, awarded credit lines, sureties, payment method, payment overview, deposits and other guarantees."]
[null,"Compensation","Details regarding claimed compensations, paid amounts or other types of compensation."]
[null,"Permits ","Permits held by data subjects."]
[null,"Personal details","Age, sex, date of birth, place of birth, marital status, nationality."]
[null,"Physical health data","Medical file, medical report, diagnostic information, treatment, results of analysis, handicap or infirmity, diet; other special demands related to the health when managing a trip or a residence."]
[null,"Mental health data","Medical file, medical report, diagnostic information, treatment, results of analysis."]
[null,"HR Files","Personnel files, performance records, payroll etc."]
[null,"Images","Camera recording, photographic recording, video recording, digital photos, X-Ray etc."]
[null,"Surveillance images","Images of security cameras."]
[null,"Sound recordings","Tape recordings, phone recordings, etc."]
[null,"Legal","Child care order, Directions, reports, Ward of Court. Court reports, Patient Care legal input."]
[null,"Other (Please specify)","To be described by the controller."]
[null,"Who the Data is Shared with"]
[null,"The data subject him- or herself"]
[null,"The nominated contact person - personal/legal rep."]
[null,"GPs"]
[null,"Dentists"]
[null,"Pharmacists"]
[null,"Opticians"]
[null,"Health Professionals involved in care"]
[null,"HSE staff (need to know basis)"]
[null,"Service Providers "]
[null,"Legal representatives of the HSE"]
[null,"Revenue commissioner "]
[null,"Courts and law enforcement"]
[null,"Government Offices/Agencies "]
[null,"Banks"]
[null,"Insurance companies "]
[null,"Ombudsman"]
[null,"Ombudsman for Children"]
[null,"Information Commissioner"]
[null,"Professional Bodies"]
[null,"Data Protection Commission"]
[null,"Suppliers/Vendors & Contractors "]
[null,"Medical Officer of Health  (public Health officer)"]
[null,"National Cancer Registry"]
[null,"HIQA"]
[null,"Public Representatives"]
[null,"Private Hospitals"]
[null,"Debt Collection Agencies"]
[null,"   Mental Health Commission,  Coru, regulatory bodies, "]
[null," Tusla"]
[null," Trade Unions"]
[null,"  Advocacy"]
[null,"  Various ==> see next column"]
[null,".."]
[null,"Others (Please Specify)"]
[null,"Basis for Processing"]
[null,"Basis for Processing","Explanation"]
[null,"Consent ","The data subject has given consent to the processing of his or her personal data for one or more specific purposes (GDPR Article 6(1)(a)).\nNote that the consent must meet the requirements as determined by GDPR Article 7."]
[null,"Performance of a contract","The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (GDPR Article 6(1)(b))."]
[null,"Legal obligation","The processing is necessary for compliance with a legal obligation to which the controller is subject (GDPR Article 6(1)(c))."]
[null,"Vital Interests","The processing is necessary in order to protect the vital interests of the data subject or of another natural person (GDPR Article 6(1)(d))."]
[null,"Public Interest/Official Authority ","The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (GDPR Article 6(1)(e))."]
[null,"Safeguards for Third Country Transfers"]
[null,"Nature","Explanation"]
[null,"N/A"]
[null,"Adequacy decision","GDPR Article 45"]
[null,"Appropriate safeguards","GDPR Article 46"]
[null,"BCRs","GDPR Article 47"]
[null,"Specific situation","GDPR Article 49(1)"]
[null,"GDPR Article 49(2)","GDPR Article 49(2)"]