One register for everything you do with personal data. Checked against your code.
Your code shows part of the picture. Payroll, CCTV, the call centre and the paper forms at reception never touch a repository. The Processing Register keeps all of it in one record of processing, asks the people who run each process for their part, and checks the part code can prove against the code.
What the code shows, and what only people know.
Activities that run through your applications are seeded from the scans: the personal data, the systems that store it and the third parties it reaches. Everything else comes in from a sheet you already have, or from a questionnaire. Each row says where it came from, so nobody has to guess which parts were checked and which were stated.
A link to the HR lead, not a workshop.
Send a questionnaire to the owner of each process: HR, the front office, facilities, a vendor. They answer from a link, with no account, and the answers save as they go. Reminders go out before the due date. You review the answers and commit them, and they become rows of the register.
Questionnaires for general processing, HR, healthcare, financial services, e-commerce and education, for systems and vendors, and for impact assessments. Or turn your own Word or Excel questionnaire into one.
When the interview and the code disagree, you see it.
A flow the code shows but nobody declared is marked code only, for a decision: adopt it into the record or explain it. A flow declared in an interview that the code never shows is marked too. Each new scan runs the comparison again, and a flow that stops appearing in the code is marked stale rather than quietly kept.
Here the patient portal sends a patient's photo, licence number, name and phone to an identity check vendor. Nobody listed that vendor in an interview. The code did.
What is missing, and the provision that asks for it.
Rules run over the register itself: a recipient with no processing agreement, sensitive data with no encryption recorded, no retention rule, no lawful basis. Each finding names the provision and what to do, and goes away when the row it points at is fixed. Activities that need an impact assessment are flagged, and the assessment runs as a questionnaire with sign-off.
Something you can hand over.
Export the record of processing in the DPDPA layout or the GDPR Article 30 layout, as a spreadsheet, a PDF or JSON, with the list of sub-processors and the data-flow diagram. Every version is kept, so you can show what changed between two reviews. Consultants can put their own name on the exports and hand the whole engagement over as one bundle.
It stays true after the first sign-off.
Each activity has a review date. When it comes due, the owner is asked to confirm it still holds, and their answer is kept as an attestation.
Anyone can propose a change to an activity. It is reviewed and decided, not edited in place, so the history shows who changed what and why.
Processing agreements with their dates, a risk tier, a review cadence and an assessment you can send. A vendor being offboarded is visible as such.