Records of processing activities: how to apply Article 30 GDPR

A record of processing activities under Article 30 GDPR should not be merely a list of software and departments. It should show which personal data an organisation processes for which purpose, who is affected, which recipients receive the data and which retention periods and safeguards are intended.

This article explains how controllers and processors can build and maintain a practical record. The focus is the documentation duty under Article 30 GDPR. A general erasure concept, a complete record of technical and organisational measures or a separate assessment of the controller and processor roles are not replaced by the record.

Article 30(1) GDPR generally requires controllers to keep a record of all processing activities under their responsibility. The entry starts with the specific activity, not the name of a department or application. “CRM” or “human resources” does not yet explain which data are processed for which purpose.

For controllers, Article 30(1) GDPR lists, among other things, contact details, purposes, categories of individuals and personal data, recipients and any transfers to third countries or international organisations. Where possible, the record should also include intended retention periods and a general description of the technical and organisational measures under Article 32(1) GDPR.

The record must be kept in writing, including electronically, and made available to the supervisory authority on request. It is therefore not a marketing text or a general privacy policy, but a traceable overview of actual processing activities.

Controllers record processing activities under their responsibility. Processors record the categories of processing carried out on behalf of each controller. These records have different perspectives and should not be replaced by a generic role label.

The key question is who determines the purpose and essential means. An organisation may be a controller for one activity and a processor for another. An agency or platform may also pursue its own purposes or participate in a joint decision under Article 26 GDPR. The role check helps structure an initial assessment, but it does not replace reviewing the actual data flow.

The record should match contracts and actual use. A contract calling a relationship processing does not by itself establish what processing takes place. For a deeper distinction, see the practical assessment of joint controllership involving agencies and platforms.

Start with an understandable name for the processing activity and its specific purpose. Then describe which individuals are affected, such as customers, employees, applicants or event participants, and which data categories are actually used. Collective terms such as “all customer data” make a review harder.

Recipients should be recorded according to the activity and data flow. They may include internal teams, processors, group companies, authorities or other recipients. Where data are transferred to third countries, the record should identify the country, recipient and relevant transfer documentation. The article on documenting international transfers with SCCs and a TIA covers the additional review path.

For retention periods, Article 30 GDPR requires information where possible. A single fixed period for all data is rarely appropriate. Assign the trigger, data category and relevant retention rule. The Article 30 record only needs a general description of technical and organisational measures where possible when detailed evidence is kept elsewhere and clearly linked.

A record usually becomes outdated through organisational change rather than on one particular date. A new CRM, another cloud provider, an additional interface, a changed audience or a new recipient may alter an existing entry. Define which events trigger an update.

Maintenance should not be left only to a privacy function when business units, IT and procurement create the changes. Approval points can be useful for procurement, product development, human resources and marketing campaigns. The record should contain a version, review date, open questions and responsible people.

Regularly compare the record with privacy notices, processing agreements, erasure rules and security evidence. The page on privacy governance for organisations helps anchor these responsibilities. For Article 32 safeguards, the article on documenting security measures is a useful complement, not a replacement for the Article 30 record.

Article 30(5) GDPR contains an exception for organisations with fewer than 250 employees. It does not apply where processing is likely to create a risk to the rights and freedoms of individuals, is not occasional, or involves special categories of data under Article 9 or data relating to criminal convictions and offences under Article 10 GDPR.

The number of employees therefore does not decide the issue by itself. Regular customer administration, ongoing human resources processing, recurring communications or systems involving increased risk may argue against relying on a general exception. Consider also whether several activities belong together and how the organisation would support its conclusion.

In practice, a concise and current record is often the better organisational instrument even where an exception is considered. It makes data flows visible and helps align privacy information, contracts and safeguards. Any decision should be documented with the relevant facts, scope and risk.

A software list: Product names do not show which purposes, data categories and recipients are connected with the activity.

One entry for the whole organisation: Different purposes, groups of individuals and data flows become mixed and difficult to review.

Applying the exception automatically: Fewer than 250 employees does not automatically remove the Article 30 GDPR duty.

Reading only the contract: Actual use may differ from a role label or service description.

Failing to update the record: New providers, recipients, systems and purposes remain absent even though the data flow has changed.

Confusing the record with detailed evidence: The record may link to erasure, security or transfer documentation, but it does not replace those records.

We review the actual processing activities with you, structure the information required by Article 30 GDPR and compare it with contracts, privacy notices, erasure rules and security evidence. Contact us with your existing record or a new processing activity so that missing information, responsibilities and the next sensible review step can be identified clearly.