FieldRegister
Every field · Behaviour, engagement and scoring

Email opens and clicks

An open is a pixel firing and a click is a rewritten link; both are behavioural monitoring of a named person and need a notice, and in most regimes consent.

personal data
personal data?
standard
sensitivity
needs a basis
AI use
consent for the tracking pixel and rewritten links, plus a basis for any scoring built on it
lawful basis usually relied on

Keep it how long

Short: 12 months, then aggregate.

The gap we see most

Open and click counts used to score people in a country where the pixel itself needed consent.

What holding it is evidence for

Requirement text and artefacts stated in our own words from the published standards.

Scoring and profiling of people GDPR Art.22 · GDPR Art.13 · GDPR Art.35 · CCPA/CPRA CCR 7220 · ISO/IEC 27701:2019 7.3.10
GDPR Art.22 Automated individual decision-making, including profiling

Do not subject a data subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract between the data subject and the co...

Evidence an auditor accepts: An inventory of automated decisions with the assessment of whether each produces legal or similarly significant effects; The exception relied on for each in scope decision, and for contract based ones the necessity reasoning rather than a convenience argument; The human intervention process, showing the reviewer has the authority and the information to change the outcome
GDPR Art.13 Information to be provided where personal data are collected

Where personal data is collected from the data subject, provide at the time it is obtained the identity and contact details of the controller and any representative, the contact details of the data protection officer, the purposes and the legal basis, the legitimate interests where that is the basis...

Evidence an auditor accepts: The privacy notice mapped item by item against every information element Article 13 lists; Evidence of the point and timing at which the notice is presented for each collection channel, including forms, telephone and in person; The storage periods or criteria as published, reconciled against the actual retention schedule
GDPR Art.35 Data protection impact assessment

Where a type of processing, in particular using new technologies and taking account of the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, carry out an assessment of the impact of the envisaged processing operat...

Evidence an auditor accepts: The screening or threshold process applied to new and changed processing, with its outcomes recorded including the negative ones; Completed assessments checked against the four minimum content elements Article 35(7) requires; The data protection officer's advice sought and given on each assessment, recorded as advice rather than as approval
CCPA/CPRA CCR 7220 Give a pre-use notice before using ADMT for significant decisions

Applies from 1 January 2027 to ADMT already in use for significant decisions, and from first use for later deployments (7200). Before collecting the data to be processed by the ADMT, or before repurposing data already held, the business must give a prominent pre-use notice in its usual channel stati...

Evidence an auditor accepts: Pre-use notice text for each ADMT used for a significant decision; Inventory of ADMT uses with the significant decision each supports; Description of the alternative process for consumers who opt out
ISO/IEC 27701:2019 7.3.10 Automated decision making

The organization must identify and address the obligations, including legal obligations, that it owes to individuals arising from decisions it makes about them based solely on automated processing of their personal data, taking account of jurisdictions that impose specific obligations where such dec...

Evidence an auditor accepts: Inventory of decisions made solely by automated processing, with their effect on individuals assessed; Obligations register per jurisdiction for those decisions; Notification content disclosing the existence and logic of automated decision making
Behavioural tracking synced to the record GDPR Art.6 · GDPR Art.7 · CCPA/CPRA CCR 7025 · ISO/IEC 27701:2019 7.2.3
GDPR Art.6 Lawfulness of processing

Process personal data only where at least one lawful basis applies: the data subject's consent, necessity for a contract with the data subject or pre-contractual steps at their request, compliance with a legal obligation, protection of vital interests, performance of a public interest task or exerci...

Evidence an auditor accepts: A lawful basis recorded per processing activity, not per system or per department; Legitimate interests assessments showing the interest pursued, the necessity test and the balancing against the data subject's rights; The Union or Member State provision cited where the basis is legal obligation or public task
GDPR Art.7 Conditions for consent

Where processing rests on consent, be able to demonstrate that the data subject consented. Where the consent request forms part of a wider written declaration, present it in a manner clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain ...

Evidence an auditor accepts: Consent records capturing who consented, when, to what wording, and through what mechanism; The consent wording and interface as presented, versioned, so an old record can be tied to what was actually shown; The withdrawal mechanism, with evidence it works and takes no more steps than giving consent did
CCPA/CPRA CCR 7025 Process opt-out preference signals

A business that sells or shares data must treat a widely recognised browser or device signal, such as Global Privacy Control, as a valid opt-out for that browser or device and every profile linked to it, including pseudonymous ones, and for the consumer where known. It may not ask for more than the ...

Evidence an auditor accepts: Technical design showing GPC detection at page load and suppression of selling or sharing tags; Test results from browsing with the signal enabled, including network captures; Website display of the signal status to the visitor
ISO/IEC 27701:2019 7.2.3 Determine when and how consent is to be obtained

The organization must determine and document a process by which it can demonstrate whether, when and how consent to processing was obtained, clearly documenting when consent is needed and what obtaining it requires, correlating purposes with how consent is obtained, and taking into account jurisdict...

Evidence an auditor accepts: Documented consent process covering when consent is required and what valid consent demands; Mapping from each purpose to whether and how consent is obtained; Analysis of jurisdiction specific consent requirements and how the mechanism meets them

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Lead score, propensity or ranking · Website visits, page views, sessions