What record should be maintained regarding Personal Data processed on behalf of the Controller?
A special record should be maintained, including the data of the Controller, the Processor, and the Data Protection Officer, as well as a description of the categories of Personal Data they have, data of authorized persons accessing Personal Data, processing times, restrictions and scope, mechanisms for erasing, modifying or processing Personal Data, purpose of processing, data related to cross-border movement and processing, and technical and organizational measures for information security and processing operations. This record should be submitted to the Bureau upon request.