3.4 What kind of information do I have to document in the register?

For each processing, the register must contain information about:

• The title, description and objectives of the study
• Primary or secondary processing of personal data
• The categories of personal data that are collected
• The categories of data subjects about whom personal data are collected
• With secondary processing: whether the data subjects can be informed about the processing
• Overview of the technical and organizational measures to be taken to guarantee the privacy and rights of those involved and how long the data will be kept
• The rights of those involved and whether exceptions should be provided for
• The legal basis for the processing
• with whom the data is shared (within or outside the EEA)
• Checklist to determine whether an additional risk analysis must be performed