Bürowerk

processing record

Takes an inventory — the controller, and one entry per processing activity with its purposes, the stated legal basis, the categories of data subjects and of personal data, the categories of recipients, any third-country transfers, the erasure periods and the security measures — and returns it laid out as a draft record of processing activities under Article 30(1) GDPR. Every activity comes back mapped item by item onto letters (a) through (g) of that article, each letter marked present or.

POST https://buero.halowerk.com/v1/processing-record

Eingaben

Felder des veröffentlichten Eingabeschemas
Feld	Typ	Pflicht	Beschreibung
controller	object	Ja	The controller — Article 30(1)(a). Required.
representative	object	Nein	The representative under Article 27, where one is appointed. Article 30(1)(a).
dpo	object	Nein	The data protection officer, where one is appointed. Article 30(1)(a).
joint_controllers	array	Nein	Joint controllers under Article 26, where there are any. Article 30(1)(a).
activities	array	Ja	One entry per processing activity. This is an inventory of activities, not a log of events.
record_language	string	Nein	Language of the article texts printed beside each letter. Your own wording is never translated.

Vollständiges Eingabeschema anzeigen

{
  "type": "object",
  "required": [
    "controller",
    "activities"
  ],
  "additionalProperties": false,
  "properties": {
    "controller": {
      "type": "object",
      "additionalProperties": false,
      "description": "The controller — Article 30(1)(a). Required.",
      "required": [
        "name"
      ],
      "properties": {
        "name": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300,
          "description": "Legal name of the body."
        },
        "address": {
          "type": "string",
          "maxLength": 500,
          "description": "Postal address as one line."
        },
        "email": {
          "type": "string",
          "maxLength": 200,
          "description": "Contact mailbox of the body. A functional address, not a person."
        },
        "phone": {
          "type": "string",
          "maxLength": 60,
          "description": "Contact number of the body."
        }
      }
    },
    "representative": {
      "type": "object",
      "additionalProperties": false,
      "description": "The representative under Article 27, where one is appointed. Article 30(1)(a).",
      "required": [
        "name"
      ],
      "properties": {
        "name": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300,
          "description": "Legal name of the body."
        },
        "address": {
          "type": "string",
          "maxLength": 500,
          "description": "Postal address as one line."
        },
        "email": {
          "type": "string",
          "maxLength": 200,
          "description": "Contact mailbox of the body. A functional address, not a person."
        },
        "phone": {
          "type": "string",
          "maxLength": 60,
          "description": "Contact number of the body."
        }
      }
    },
    "dpo": {
      "type": "object",
      "additionalProperties": false,
      "description": "The data protection officer, where one is appointed. Article 30(1)(a).",
      "required": [
        "name"
      ],
      "properties": {
        "name": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300,
          "description": "Legal name of the body."
        },
        "address": {
          "type": "string",
          "maxLength": 500,
          "description": "Postal address as one line."
        },
        "email": {
          "type": "string",
          "maxLength": 200,
          "description": "Contact mailbox of the body. A functional address, not a person."
        },
        "phone": {
          "type": "string",
          "maxLength": 60,
          "description": "Contact number of the body."
        }
      }
    },
    "joint_controllers": {
      "type": "array",
      "maxItems": 20,
      "description": "Joint controllers under Article 26, where there are any. Article 30(1)(a).",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "description": "One joint controller.",
        "required": [
          "name"
        ],
        "properties": {
          "name": {
            "type": "string",
            "minLength": 1,
            "maxLength": 300,
            "description": "Legal name of the body."
          },
          "address": {
            "type": "string",
            "maxLength": 500,
            "description": "Postal address as one line."
          },
          "email": {
            "type": "string",
            "maxLength": 200,
            "description": "Contact mailbox of the body. A functional address, not a person."
          },
          "phone": {
            "type": "string",
            "maxLength": 60,
            "description": "Contact number of the body."
          }
        }
      }
    },
    "activities": {
      "type": "array",
      "minItems": 1,
      "maxItems": 100,
      "description": "One entry per processing activity. This is an inventory of activities, not a log of events.",
      "items": {
        "type": "object",
        "required": [
          "name",
          "purposes"
        ],
        "additionalProperties": false,
        "properties": {
          "name": {
            "type": "string",
            "minLength": 1,
            "maxLength": 200,
            "description": "Short label of the activity, e.g. \"Payroll\" or \"Applicant management\"."
          },
          "purposes": {
            "type": "array",
            "minItems": 1,
            "maxItems": 20,
            "description": "Article 30(1)(b). One purpose per entry, in your own words.",
            "items": {
              "type": "string",
              "minLength": 1,
              "maxLength": 500
            }
          },
          "legal_basis": {
            "type": "array",
            "maxItems": 6,
            "description": "Which of Article 6(1)(a) to (f) you rely on. Your statement — it is recorded, not chosen or checked here.",
            "items": {
              "type": "string",
              "enum": [
                "art6_1_a_consent",
                "art6_1_b_contract",
                "art6_1_c_legal_obligation",
                "art6_1_d_vital_interests",
                "art6_1_e_public_task",
                "art6_1_f_legitimate_interests"
              ]
            }
          },
          "legitimate_interests_description": {
            "type": "string",
            "maxLength": 2000,
            "description": "The interests relied on, where art6_1_f_legitimate_interests is named. Recorded as stated; no balancing test is performed here."
          },
          "special_category_basis": {
            "type": "array",
            "maxItems": 8,
            "description": "Which of Article 9(2) you rely on, where special categories of data are processed.",
            "items": {
              "type": "string",
              "enum": [
                "art9_2_a_explicit_consent",
                "art9_2_b_employment_law",
                "art9_2_c_vital_interests",
                "art9_2_f_legal_claims",
                "art9_2_g_substantial_public_interest",
                "art9_2_h_health_care",
                "art9_2_i_public_health",
                "art9_2_j_archiving_research"
              ]
            }
          },
          "data_subject_categories": {
            "type": "array",
            "maxItems": 30,
            "description": "Article 30(1)(c), first half. Categories, e.g. \"employees\", \"applicants\" — never individuals.",
            "items": {
              "type": "string",
              "minLength": 1,
              "maxLength": 200
            }
          },
          "data_categories": {
            "type": "array",
            "maxItems": 60,
            "description": "Article 30(1)(c), second half. Categories, e.g. \"contact data\", \"payroll data\" — never values.",
            "items": {
              "type": "string",
              "minLength": 1,
              "maxLength": 200
            }
          },
          "special_categories": {
            "type": "array",
            "maxItems": 12,
            "description": "Which special categories under Article 9(1) occur, if any.",
            "items": {
              "type": "string",
              "enum": [
                "racial_or_ethnic_origin",
                "political_opinions",
                "religious_or_philosophical_beliefs",
                "trade_union_membership",
                "genetic_data",
                "biometric_data",
                "health_data",
                "sex_life_or_orientation"
              ]
            }
          },
          "recipient_categories": {
            "type": "array",
            "maxItems": 40,
            "description": "Article 30(1)(d). Categories of recipients, e.g. \"payroll provider\", \"tax authority\".",
            "items": {
              "type": "string",
              "minLength": 1,
              "maxLength": 300
            }
          },
          "third_country_transfers": {
            "type": "array",
            "maxItems": 30,
            "description": "Article 30(1)(e). One entry per destination outside your own establishment. Destinations inside the EEA are recorded and marked as such.",
            "items": {
              "type": "object",
              "required": [
                "country_code"
              ],
              "additionalProperties": false,
              "properties": {
                "country_code": {
                  "type": "string",
                  "minLength": 2,
                  "maxLength": 2,
                  "description": "ISO 3166-1 alpha-2, uppercase, e.g. US."
                },
                "recipient_category": {
                  "type": "string",
                  "maxLength": 300,
                  "description": "Category of recipient in that country."
                },
                "safeguard": {
                  "type": "string",
                  "enum": [
                    "adequacy_decision_art45",
                    "scc_art46_2_c",
                    "bcr_art47",
                    "codes_of_conduct_art46_2_e",
                    "certification_art46_2_f",
                    "derogation_art49",
                    "none_stated"
                  ],
                  "description": "The safeguard you rely on under Article 46 or 49. Recorded as stated."
                },
                "safeguard_reference": {
                  "type": "string",
                  "maxLength": 500,
                  "description": "Where the safeguard is documented, e.g. a contract reference. Recorded, not retrieved."
                }
              }
            }
          },
          "retention_period_days": {
            "type": "integer",
            "minimum": 0,
            "maximum": 36525,
            "description": "Article 30(1)(f). Erasure period in days, where a fixed one applies. Unit is in the name: days."
          },
          "retention_criteria": {
            "type": "string",
            "maxLength": 2000,
            "description": "Article 30(1)(f). The criteria for erasure where no fixed period applies, e.g. \"six years after the end of the contract year\"."
          },
          "security_measures": {
            "type": "array",
            "maxItems": 40,
            "description": "Article 30(1)(g). General description of the technical and organisational measures under Article 32(1).",
            "items": {
              "type": "string",
              "minLength": 1,
              "maxLength": 500
            }
          },
          "systems": {
            "type": "array",
            "maxItems": 40,
            "description": "The systems the activity runs in. Not required by Article 30; carried through because a record without systems is hard to maintain.",
            "items": {
              "type": "string",
              "minLength": 1,
              "maxLength": 200
            }
          },
          "processors": {
            "type": "array",
            "maxItems": 40,
            "description": "Processors under Article 28. Not required by Article 30(1); carried through unchanged.",
            "items": {
              "type": "string",
              "minLength": 1,
              "maxLength": 300
            }
          }
        }
      }
    },
    "record_language": {
      "type": "string",
      "enum": [
        "de",
        "en"
      ],
      "default": "de",
      "description": "Language of the article texts printed beside each letter. Your own wording is never translated."
    }
  }
}

Originalschema öffnen

Veröffentlichtes Eingabebeispiel

{
  "controller": {
    "name": "Nordlicht GmbH",
    "address": "Hafenstrasse 4, 20359 Hamburg",
    "email": "datenschutz@nordlicht.example"
  },
  "dpo": {
    "name": "Anna Berger",
    "email": "dsb@nordlicht.example"
  },
  "activities": [
    {
      "name": "Personalverwaltung",
      "purposes": [
        "Durchfuehrung des Arbeitsverhaeltnisses",
        "Lohnabrechnung"
      ],
      "legal_basis": [
        "art6_1_b_contract",
        "art6_1_c_legal_obligation"
      ],
      "data_subject_categories": [
        "Beschaeftigte",
        "Bewerberinnen und Bewerber"
      ],
      "data_categories": [
        "Stammdaten",
        "Vertragsdaten",
        "Abrechnungsdaten"
      ],
      "recipient_categories": [
        "Lohnbuero",
        "Finanzamt",
        "Sozialversicherungstraeger"
      ],
      "retention_period_days": 3650,
      "retention_criteria": "Zehn Jahre nach Ende des Arbeitsverhaeltnisses wegen handels- und steuerrechtlicher Aufbewahrungspflichten.",
      "security_measures": [
        "Rollenbasierte Zugriffsrechte",
        "Verschluesselung im Ruhezustand",
        "Protokollierung administrativer Zugriffe"
      ],
      "systems": [
        "HR-Suite"
      ]
    },
    {
      "name": "Newsletter",
      "purposes": [
        "Versand des Kundennewsletters"
      ],
      "legal_basis": [
        "art6_1_a_consent"
      ],
      "data_subject_categories": [
        "Newsletter-Abonnenten"
      ],
      "data_categories": [
        "Kontaktdaten",
        "Einwilligungsnachweis"
      ],
      "recipient_categories": [
        "Versanddienstleister"
      ],
      "third_country_transfers": [
        {
          "country_code": "US",
          "recipient_category": "Versanddienstleister",
          "safeguard": "scc_art46_2_c",
          "safeguard_reference": "Auftragsverarbeitungsvertrag 2026-014, Anlage 2"
        }
      ],
      "retention_criteria": "Bis zum Widerruf der Einwilligung, danach Loeschung binnen 30 Tagen.",
      "security_measures": [
        "Double-Opt-in",
        "Zugriff nur ueber Zwei-Faktor-Anmeldung"
      ],
      "systems": [
        "Mailversand"
      ]
    }
  ]
}

Ergebnis & Dokumentation

Maschinenlesbare Dokumentation dieses Hubs

Quelle dieser Seite: der veröffentlichte HALOWERK-Katalog. Stand: 2026-11-01, 15:19 UTC.

Weitere Endpunkte dieses Hubs

Bürowerk0,002 USDC
availability resolve
POSThttps://buero.halowerk.com/v1/availability-resolve
Give it a search window, a meeting length, and for each participant a list of busy blocks — start and end, nothing else — and it returns the windows in which the meeting fits. Each participant carries their own IANA timezone and working hou
Bürowerk0,004 USDC
mail / allowed domain partition
POSThttps://buero.halowerk.com/v1/baumarkt/mail/allowed-domain-partition
Partner campaign: partition rows by explicitly allowed domains. Reuses the existing email-list-clean motor. No SMTP probes or mailbox existence/catch-all proof. Local part case, plus and dots are never folded. Up to500 source rows;65s engin
Bürowerk0,004 USDC
mail / baseline added
POSThttps://buero.halowerk.com/v1/baumarkt/mail/baseline-added
CRM synchronization: addresses newly appearing after baseline. Reuses the existing email-list-clean motor. No SMTP probes or mailbox existence/catch-all proof. Local part case, plus and dots are never folded. Up to500 source rows;65s engine

Alle Endpunkte dieses Hubs →

processing record

Eingaben

Veröffentlichtes Eingabebeispiel

Ergebnis & Dokumentation

Weitere Endpunkte dieses Hubs

availability resolve

mail / allowed domain partition

mail / baseline added