Guide to the Company Description for GénIA

For the Global Analysis to generate a truly useful GDPR project, it is essential to provide GénIA with the minimum information about the company context. This page helps you correctly fill out the "General Information > Company description" section in Privacy Evo.

Important GénIA can speed up the compilation, but the results must be reviewed before operational use. The clearer the provided context, the more consistent and complete the output will be.

Quick Index

Minimum information 1. Organization identity 2. Locations and workspaces
3. Activities and processes 4. Privacy roles 5. Processing methods 6. Security measures
Start here

Minimum information to provide to GénIA

If you are short on time, make sure to at least include this information: it is the basis for generating a coherent GDPR project.

  • Company name, legal form, registered office, and VAT/Tax ID
  • Operational branches (if any) and main departments/areas
  • Activities involving data processing (e.g., HR, customers, marketing, video surveillance)
  • Roles and involved parties (controller, privacy referents, authorized personnel, data processors)
  • Processing methods and tools (paper/electronic, management software, email, archives)
  • Main security measures (technical, physical, organizational)
Immediate benefit An accurate description allows Privacy Evo to correctly structure locations, roles, processing activities, and security measures, reducing manual tasks and risks of inconsistency.
1

Organization identity

Used to correctly identify the Data Controller and associate processing activities with the right organization.

  • Full company name
  • Registered office and operational branches
  • Tax ID and VAT number
  • Legal representative
  • Website, contacts (phone, email, certified email)
Example: ALPHATECH SERVICES S.R.L., with legal and operational headquarters in Via Innovazione 25 – 20100 Milan, VAT 01234567890. Sole Director and legal representative Luca Bianchi. Company website URL: alphatechsrl.it Certified Email (PEC): alphatechsrl@pec.it Tel./Fax: 02.345577889/99
2

Locations, facilities, and workspaces

Helps Privacy Evo associate processing activities with physical locations and evaluate physical/logistical security measures.

  • Location types (registered office, secondary branches)
  • Present offices and departments
  • Public areas and restricted areas
  • Presence of archives, server rooms, reception, etc.
Example: The company headquarters includes administrative offices, commercial area, executive offices, protected paper archive, server room, and reception area. There is a decentralized operational branch in Corso Magenta 34 – 20100 Milan.
3

Company activities and operational processes

Activities allow Privacy Evo to automatically generate processing activities and the Record of Processing Activities.

  • List all activities involving personal data (including on behalf of third parties)
  • Indicate if you do B2B marketing, HR, customer care, video surveillance, etc.
  • Specify services/production/channels when relevant
Example: - IT services and technical support - administrative and accounting management - human resources management - commercial activities and B2B marketing - operational support to client companies - video surveillance
4

Privacy roles and involved parties

Allows for the automatic setup of appointments, responsibilities, and authorizations.

  • Data Controller
  • Privacy referents (if any)
  • Authorized persons (tasks, permissions, hierarchy)
  • Data Processors (identifying data and entrusted processing activities)
  • If the organization is a Processor for third parties: who confers the appointment and for which processing activities
Example (excerpt): Data Controller: ALPHATECH SERVICES S.R.L. Privacy referent: Giuseppe Neri (appointed by the controller). Authorized personnel: administrative staff, IT technicians, sales staff (associated permissions and processing). Data Processors: labor consultant, accountant, cloud provider. The Controller is appointed as Data Processor by TechService Srl and ABCService Srl for "IT services and technical support".
5

Data processing methods

Used to detail the operational methods of processing activities (tools and channels).

  • Tools used (management software, CRM, HR software, email, etc.)
  • Paper and/or electronic methods
  • Where archives and media reside (cabinets, server rooms, cloud, etc.)
Example: Personal data is processed using management software, company email, and paper archives kept in locked cabinets, located in the main headquarters.
6

Security measures

Helps enhance security and accountability with IT, physical, and organizational measures.

  • Technical: antivirus, firewall, backups, MFA, encryption (if present)
  • Physical: access control, locks, alarms, restricted areas
  • Organizational: internal policies, training, credential management, authorizations
Example: Antivirus, firewall, periodic backups, access control, internal policies, and staff training.
Expected result A comprehensive description allows Privacy Evo to automatically generate the project, reduce setup times, improve document consistency, and support compliance with Regulation (EU) 2016/679.

Practical tip

If you are about to start the Global Analysis, you can:

  • Paste the description in a single, ordered text
  • Use bullet points for roles and activities
  • Always indicate addresses and parties with identifying data
Go to the Global Analysis guide
Note If you already have a company registration report, org chart, procedures, and policies, upload them: they significantly increase the accuracy of the results.