Key points
- The record of processing activities is required by Article 30 of the GDPR for controllers and processors, subject to a limited exception.
- It serves as an official map ensuring traceability of the nature of the data, its use, its retention period and its recipients.
- Any organisation employing 250 or more people is subject to it; below that threshold, the exemption applies only to processing that is occasional, involves no risk and includes no sensitive or criminal-offence data.
- The record must include the controller, the purposes, the categories of data subjects and of data, the recipients and transfers outside the EU.
- It must also specify the time limits for erasure and a description of the technical and organisational security measures.
- Creating it requires a methodical approach involving the IT, HR and marketing departments to map data flows accurately.
Setting up a record of processing activities is now a fundamental obligation for most organisations that process personal data. This requirement, laid down by Article 30 of the GDPR, applies to businesses as well as associations, local authorities and self-employed professionals. Mastering the creation of the record and organising its upkeep not only helps you comply with the legal framework but also strengthens the protection of personal data within your organisation over the long term. Here is a methodical guide, illustrated with practical examples, to support you through the process.
What is the purpose of a GDPR record of processing activities?
The record of processing activities serves as the official map of all the data processing carried out by an organisation. It ensures full traceability of the nature of the information collected, its use, its retention period and the recipients involved. Managing the record in a structured way promotes transparency and improves the ability to respond quickly to requests from the authorities during an inspection.
Everyone involved in personal data protection, whether controllers or processors, should treat this tool as a lever for continuous improvement. A well-kept record simplifies risk management, demonstrates a proactive commitment to GDPR compliance and showcases the approach to employees and external partners.
Who must keep a record of processing activities?
The legal obligation to keep a GDPR record applies to most private and public bodies, except in cases strictly defined by the regulation. Under Article 30 of the GDPR, any organisation employing 250 or more people is subject to it. Below this threshold, the exemption applies only if the processing is occasional, does not involve sensitive data or data relating to criminal convictions and offences, and is not likely to result in a risk to the rights and freedoms of data subjects.
Even where the law does not formally require you to keep a record, it is still strongly recommended to do so. It makes it easier to keep control of your legal obligations, to steer internal changes and to justify the technical and legal choices made by the organisation. Where legal support becomes necessary to make your compliance legally sound, it may be worth seeking the assistance of a GDPR lawyer, in particular for drawing up records of processing and overseeing rights of access to data.
What information must the record contain?
To ensure the compliance of the record, certain items are mandatory:
- Name and contact details of the controller and, where applicable, of its representative
- Purposes pursued for each processing operation
- Categories of data subjects and of data processed
- Any recipients of the personal data (internal or external)
- Transfers of data to third countries outside the EU
- Envisaged time limits for erasure of the categories of data
- General description of the technical and organisational measures in place to ensure security
In addition, a record template may include extra columns to make monitoring easier: whether an impact assessment exists, the legal basis for the processing, how data subjects are informed, and so on. For those who want to show the authorities that they actually comply with the regulation, there are proven methods to prove GDPR compliance through a documented record of processing (in French).
The rigour applied to choosing and updating the fields to be completed raises the level of personal data protection and improves GDPR compliance over time.
How should you organise the creation of the record?
Drawing up the record for the first time requires a methodical approach combining a precise inventory and cross-checks. Involving operational teams from this stage helps identify points where data is collected or shared that might escape a purely administrative view. Below is a sound method for building this essential document and keeping it alive.
Involving several departments (IT, human resources, marketing, etc.) helps build an accurate map of all personal data flows. Each one actively contributes to the final document and takes ownership of the protection logic expected by European regulation.
Key steps to draw up a GDPR record of processing activities
The creation of the record generally follows a gradual process made up of several steps:
- Identifying existing processing operations wherever personal data is handled
- Gathering technical and organisational information on the nature, purpose and circulation of the data
- Gradually completing and consolidating the record using a template suited to the business
- Internal validation with cross-review by the data protection officer and the business departments concerned
- Communicating the record and archiving it securely
Working in batches (for example, after-sales service, payroll, newsletter) speeds up the mapping, limits omissions and gives more structure to the dialogue between internal managers.
Example of a simple record template
A summary table remains the most effective format for visualising the various dimensions required. Here is an example designed to give a clear overview:
| Processing | Department responsible | Purpose | Data subjects | Data collected | Recipients | Retention period | Security |
|---|---|---|---|---|---|---|---|
| Employee management | HR department | Payroll, career management | Employees | Names, addresses, bank details | External payroll provider | 5 years after leaving | Digital vault, restricted access |
| Customer newsletter | Marketing | Commercial information | Subscribed customers | Email, purchase history | None | For the duration of the subscription | Secure server |
This template illustrates the minimum structure expected and can be expanded according to the complexity of the organisation. Columns on the legal basis or on any transfer outside the European Union can be added depending on the situation.
Keeping the GDPR record of processing up to date
Once created, the record must remain a living document: any change affecting processing operations calls for a prompt review. Neglecting this exposes the organisation to penalties during an audit. Assigning responsibility for keeping the record to a clearly identified contact, often the data protection officer (DPO), keeps it reliable and current.
Setting periodic reminders (every six months or with each new project involving data) embeds these good practices and reduces the risk of omissions. Systematically documenting every change, deletion or addition provides real assurance of personal data protection and lasting GDPR compliance.
Frequently asked questions about the GDPR record of processing activities
What must a compliant GDPR record template contain?
A compliant record template must include at least:
- The contact details of the controller
- The specific purposes of each activity
- The categories of data subjects and of data processed
- The internal and external recipients and any transfers outside the EU
- The retention periods
- The security measures applied
Additional fields, such as the legal basis, can improve the monitoring and transparency of the record.
How can you keep the record of processing activities up to date?
Appointing a dedicated data protection contact ensures continuity and quality of updates. Setting up internal alerts and holding review meetings for each new processing operation reinforces regularity. Keeping a clear history of changes supports traceability and makes it easier to demonstrate GDPR compliance during an inspection.
What checks do the authorities carry out on the GDPR record?
The authorities examine the completeness, clarity and regularity of the information recorded. Quantitative shortcomings, missing updates or major errors often lead to reprimands or corrective measures. The record serves as the foundation during audits to assess compliance with legal obligations on personal data protection.
| Aspects checked | Possible consequences |
|---|---|
| Incomplete record | Request for regularisation, formal notice |
| Failure to keep it updated | Financial penalty |
| Processing operations missing from the record | In-depth investigation, litigation risk |
Are there tools to help create and manage the record?
Various resources exist to simplify the process. You can rely on:
- Ready-to-complete Excel templates that can be adapted to your specific needs
- Dedicated software solutions to automate creation and upkeep
- Guides provided by national data protection authorities
However, you should tailor these tools so that they precisely reflect the configuration and constraints of each organisation.
