Record of processing activities under GDPR

01

What is a record of processing?

A list of the organisation's processing of personal data - for example payroll, recruitment, customer records, newsletters and CCTV. It must be in writing, including electronic form, and kept available for IMY.

02

Who needs one?

The main rule is that all controllers and processors must keep a record. There is an exemption for organisations with fewer than 250 employees, but it does not apply if the processing is likely to result in a risk to individuals, is not occasional, or includes special categories of data or data on criminal offences. Since most organisations have ongoing processing such as HR or customer records, in practice almost every organisation needs a record - at least for those activities.

03

What must it contain?

As a controller, the record must contain:

• Name and contact details of the controller and, where applicable, the data protection officer.
• The purposes of the processing.
• Categories of data subjects (for example employees, customers) and categories of personal data.
• Categories of recipients, including recipients in third countries.
• Any transfers to third countries and the safeguards used.
• Where possible, the envisaged time limits for erasure.
• Where possible, a general description of the technical and organisational security measures.

04

Controller or processor

As a processor - for example an IT supplier or a payroll bureau processing data on behalf of customers - you must keep your own, simpler record: which controllers you act for, the categories of processing you carry out, any third-country transfers and a description of the security measures. Many organisations are both: controllers for their own staff and customers, and processors in their client work.

05

Keeping it up to date

A record that was written once and then forgotten is of little use. Make it part of your routines:

• Appoint an owner and review the record at least once a year.
• Update it when you introduce a new system, supplier or purpose.
• Link it to your supplier register so that processors and third-country transfers match.
• Use it as the starting point for risk assessments and impact assessments.

06

Common mistakes

Common gaps are records that describe systems instead of purposes, missing retention periods or ones phrased as "as long as needed", cloud services storing data outside the EU/EEA being left out, and a record that doesn't match the privacy notice. Read the record and the privacy notice side by side - they should describe the same reality.