When does a data filing system needs to be registered
The notification of a data filing system to registration must be made before data processing commences, that is before the first act of processing which the controller can perform on the data i.e. before collection of any personal data. According to Article 46 (1) of the Act on the Protection of Personal Data, the data controller may start processing the data contained in a data filing system after notification to registration by the Inspector General for Personal Data Protection.
However, if the data controller intends to process sensitive data (enumerated in Article 27 of the Act i.e. personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, religious, party or trade-union membership, as well as the processing of data concerning health, genetic code, addictions or sex life and data relating to convictions, decisions on penalty, fines and other decisions issued in court or administrative proceedings) then the collection of such data, according to Article 46 (2) of the Act, may only commence after registration of the data filing system, unless the Act exempts the controller from such an obligation.


