What is a record of processing activities?
The record is an inventory of your processing activities, not of systems or data fields. A processing activity is something you do with personal data for one purpose, such as running payroll or sending a newsletter. Most organisations end up with 15 to 60 of them. The record must be in writing, which includes electronic form, and you must make it available to the supervisory authority when it asks (Article 30(3) and (4)).
Organisations with fewer than 250 employees are exempt only for processing that is occasional, unlikely to result in a risk to people and does not include special categories (Article 9) or criminal-offence data (Article 10). Payroll, customer administration and staff records are not occasional, so in practice almost every employer keeps a record for those.
What a controller has to record
| Article 30(1) | Column in your record | Example entry |
|---|---|---|
| (a) | Name and contact details of the controller, any joint controller, the representative and the DPO | Filled in once at the top of the record |
| (b) | Purposes of the processing | Paying salaries and meeting tax obligations |
| (c) | Categories of data subjects and of personal data | Employees; identification, bank account, salary, tax number |
| (d) | Categories of recipients, including in third countries | Payroll provider, tax authority, pension fund |
| (e) | Transfers to third countries and the safeguard used | None, or: United States, adequacy decision |
| (f) | Time limits for erasure, where possible | As long as national tax law requires, then deleted |
| (g) | General description of the security measures (Article 32) | Access limited to HR, two-factor sign-in, encrypted storage |
Not required by Article 30 but worth a column: the legal basis under Article 6, the business owner, the source of the data, whether a DPIA is needed and the date of the last review. You need the legal basis for your privacy notice anyway, and supervisory authorities' own models usually include it.
The processor record
If you process personal data on behalf of customers, for example as a SaaS provider, payroll bureau or IT service provider, Article 30(2) asks for a separate, shorter record:
- the name and contact details of each controller (customer) you act for, and of your own representative and DPO;
- the categories of processing you carry out for each controller;
- transfers to third countries and the safeguard used;
- a general description of your security measures.
Many organisations are both: controller for their own staff and customers, processor for the data their customers put into their service. Keep both records, clearly separated.
Example: a 40-person company
A software company with 40 employees, acting as controller. Three of its processing activities:
| Activity | Purpose and legal basis | Data subjects and data | Recipients and transfers | Retention | Security measures |
|---|---|---|---|---|---|
| Payroll and HR administration | Paying salaries, tax and social security; contract and legal obligation (Art. 6(1)(b) and (c)) | Employees; identification, contact, bank account, salary, tax number, absence days | Payroll provider (processor), tax authority, pension fund; no transfers | As long as national tax and employment law requires | Access limited to HR, two-factor sign-in, encrypted storage |
| Customer support | Answering customer questions; contract (Art. 6(1)(b)) | Customers' contacts; name, email, ticket content | Helpdesk provider (processor), EU-hosted; no transfers | 2 years after the ticket is closed | Role-based access, audit log |
| Newsletter | Product news; consent (Art. 6(1)(a)) | Subscribers; email, name, opt-in date | Email-sending provider (processor); United States, adequacy decision | Until unsubscribed; proof of consent kept 3 years | Double opt-in, access limited to marketing |
Free template (CSV)
Two CSV files that open in Excel, LibreOffice and Google Sheets: one for your record as controller, with the three example rows above, and one for your record as processor. Fill in the controller and DPO details at the top of the document you share.
Common mistakes
- One row per system ("CRM", "SharePoint") instead of per purpose, so purposes and legal bases stay vague.
- Retention written as "as long as necessary" instead of a period or the rule that sets it.
- Recipients missing processors such as cloud, email and payroll providers.
- Transfers to non-EU providers listed without the safeguard: adequacy decision, standard contractual clauses or binding corporate rules.
- A record made once for the GDPR deadline in 2018 and never reviewed since.
Keeping the record in Dazr
- One register, both roles: every processing activity records the role (controller or processor), purposes, legal basis, data subjects, data categories, recipients, transfers with their safeguard, retention, security measures and the source.
- Filled in once: controller, representative and DPO details are entered once and reused in every export.
- Linked to the rest: activities link to vendors and to DPIAs, and DPIA risks link to the risk register.
- Export: the record as PDF for the supervisory authority or an auditor, the register as Excel or CSV to work on; every change is in the activity log.
- Plan: records of processing and DPIAs are part of Pro, €99 a month, with a 14-day free trial. Free covers the GDPR breach register with its 72-hour clock.
Dazr helps you keep the record complete and current; it does not decide your legal basis or give legal advice.
Source: Regulation (EU) 2016/679 (GDPR), Article 30, and the Article 29 Working Party position paper on Article 30(5) of 19 April 2018. Last checked 7 November 2026.
Frequently asked questions
Do small companies need a record of processing?
Usually yes. The exemption for fewer than 250 employees does not cover processing that is regular, risky or involves special categories, and payroll and customer records are regular. The EU has proposed changing this threshold; check whether an amendment is in force before relying on it.
Is there an official template?
No. Article 30 prescribes the content, not a format. Several supervisory authorities publish their own models; a spreadsheet or a register in a tool is fine as long as every required item is there.
Do we have to publish the record?
No. It is an internal document that you show to the supervisory authority on request. What you tell people goes in your privacy notice.
How often should we update it?
Whenever a processing activity starts, changes or ends, and at least once a year in a full review. Record the date of the last review per activity.