Record of Processing Activities for Jira
Introduction
Register of Procedures or Record of Processing Activities is an application tool helping companies to be compliant with the Art. 30 GDPR regulations and to make an inventory of the data processing what you are doing with the concerned personal data.
In details, organizations that process personal data are required by the General Data Protection Regulation (GDPR) to keep a Record of Processing Activities, sometimes referred to as a "Article 30 record." It is meant to give a clear and thorough overview of the personal data that a company processes, including the reasons for processing it, the categories of data subjects and their personal information, and the security measures in place. Organizations can verify their compliance with GDPR standards and detect and reduce any threats to personal data by keeping track of their processing activities. Additionally, it can assist businesses maintain order and keep track of their data processing activities so they can reply to inquiries from people like data subjects.
The Unicis.RoPA app has the following primary features:
- Set by default Data Protection Officer and to which project should the application be available
- Record Processing Activities dashboard
- Edit, view, and delete records of processing activities
- Activity logs of changes
Demo
For more info please see the demo video (1:35 minute long):
Requirements
Record Processing Activities (RPA) is developed with Atlassian Forge platform. Hence, it can be only installed in Atlassian Jira Cloud product. It requires read, write, manage and storage access to your Jira account, because the Record of Processing Activities are stored in your Atlassian Cloud instance, and not shared with Unicis. Unfortunately, it can not be installed for Server and Data Jira set up.
Installation
You can install Unicis Record Processing Activities (RPA) from Atlassian Marketplace. After installation, you will be requested to grant and read access. Have in mind that Unicis RoPA application requires a storage, manage, write and read access to your Jira account, however it does not share your data with Unicis. It stays with your Atlassian Jira account.
Configuration
You need to assign RoPA app to dedicated Jira projects and to assign a default Data Protection Officer before using.
Click on Apps on the top header, click on Manage your apps, on the side panel under APPS click Register of Procedures Settings and you will see the below screen.
To assign a Jira already existing project to be enabled for RoPA you need to click on Add Project, select from the dropdown list and assign dedicated Data Protection Officer per added project.
Each project added can have different assigned Data Protection Officer.
There are two actions available: Edit and Delete. Please see below details about the actions.
Edit
You can change and edit already existing projects and reassign to different DPO.
Delete
You can delete added project.
Features
Record of Processing Activities (RoPA) app has a several features. Such as:
- Overview dashboard for Records of Processing Activities
- No limitation of records
- You can edit and change records and have audit activity log for auditors
- You can delete RPA, without deleting the Jira ticket
- You can add as much as needed documents as an attachment to the Jira ticket
RoPA app works with any Jira project templates, for instance software project, service project, HR service manage, legal service management, etc. There is no limitation.
For more details please see subsections.
Dashboard
RoPA provides you an overview dashboard for all the records of Processing Activities that are assigned for the Jira Project.
Each Jira Project has own dedicated different RPAs, hence if you want to link them you will need to use link Jira feature.
The dashboard provides you an overview of the:
- Register of Procedures
- Status
- Assigned DPO
- Review of the process
- Data Transfer
- Special Category of Personal Data and
- Actions (Edit/Delete)
Add
Open a Jira issue/ticket that you would like to assign a Record of Processing Activities. When click on three dots on the right top corner ... -> Register Record of Processing Activities.
On the next dialog, provide an input on all 5 stages by clicking Next.
Currently there is no Back possibility feature implemented on the Dialog due to the Forge UI limitation. If you need to make changes please update the record via edit feature.
You can always know in which steps you are from the above title name of the Dialog: 1/5.
Steps:
- Description/Stakeholders
- Purpose and Categories
- Recipients
- Transfer
- Security Measures/TOMs
On each steps you have an info and warning messages for more details and explanations!
Edit
Two possibilities to Edit/Update a records for RPA.
- Via the dashboard by clicking Edit icon.
- Via the Jira issue edit by clicking on three dots on the right top corner ... -> Register Record of Processing Activities.
View
You can view the Register of Procedures by clicking on the View Register of Procedures icon on the Issue Panel. You will see a tabs for five steps and its records assigned:
- Description/Stakeholders
- Purpose and Categories
- Recipients
- Transfer
- Security Measures/TOMs
Delete
You can remove Register of Procedure by clicking on trash bin button icon.
Before you delete a record you will be prompt with a dialog if you are sure to remote the Register of Procedure record, and informing you that your Jira issue will not be removed.
After clicking on Delete you are not going to be able to return the record of Register of Procedure!
Activity logs
It can be accessed when you open the Jira ticket and on Activity sections click Records of Processing Activities.
We only display changes of the records, such as:
- Created
- Deleted
- Updated
The format of displaying the changes is as follows: Example 1:
[Author] created the Record of Processing Activities (Date format M/DD/YYY H:MM AM/PM)
Example 2:
[Author] updated the Category of Perosnal Data (Date format M/DD/YYY H:MM AM/PM)
Video data -> Audio data
Pricing
Please check the Atlassian Cloud app pricing overview.
Permissions
Unicis - Record Processing Activities can perform the following actions on behalf of the user:
- App Storage scope
- Read and write to app storage service
- Create and manage issues
- Create and edit issues in Jira, post comments as the user, create worklogs, and delete issues.
- Manage project settings
- Create and edit project settings and create new project-level objects (e.g. versions and components).
- View active user profile
- View the profile details for the currently logged-in user.
- View Jira issue data
- Read Jira project and issue data, search for issues, and objects associated with issues like attachments and worklogs.
- Before you revoke permissions, we recommend you to notify the user as they will lose access to the app.
Technical details
Record Processing Activities (RPA) is build in Atlassian Forge UI kit components with the following components:
It requires the following permissions scope:
- read:jira-work
- write:jira-work
- manage:jira-project
- storage:app
Changelog
v5.1.0
Release date: 2023-08-22
Added an EU-US Data Privacy Framework (EU-US DPF) as guarantee
v5.0.0
Release date: 2022-01-11
Bug fixes and pacthed vulnerabilities
v4.0.0
Release date: 2022-12-26
Bug fixes
v3.1.0
First release with MVP scope