How to Keep a GDPR Record of Processing Activities

A record of processing activities is a document required by the GDPR (Article 30) in which you record all processes involving personal data in your organization. Without it, you cannot demonstrate compliance; during an inspection by UODO, you will have nothing to present. This guide explains what the record contains, who keeps it, how to update it, and where AI may help.

In earlier articles in the GDPR series, I discussed the importance of managing records of authorizations to process personal data and whether people can be authorized to process personal data. These matters are closely connected to maintaining the record: each processing activity should be properly documented and access to it controlled.

What is a record of processing activities?

A record of personal data processing activities is required by the GDPR (Article 30). Its main purposes are to:

1. Record data-processing activities: track how data is collected, stored, and used.
2. Ensure GDPR compliance: provide evidence of compliance with personal data protection rules.
3. Identify risks: enable analysis and assessment of risks associated with individual processing operations.
4. Promote transparency: make it easier to oversee all personal-data activities in the organization.
5. Assist with audits and inspections: the record is part of the documentation made available to supervisory authorities, such as UODO, during an inspection.
6. Manage data: help optimize processing operations and improve personal data protection.

What does a record of processing activities contain?

Under Article 30 GDPR, the record should contain the following information:

1. Data controller details: the name and contact details of the controller or joint controllers.
2. Purposes of processing: clearly defined reasons for processing data, such as performing a contract, marketing, or recruitment.
3. Categories of data subjects: for example, employees, customers, and business partners.
4. Categories of personal data: the types of data collected, such as first name, surname, email address, or telephone number.
5. Data recipients: entities to which data is transferred, such as IT companies, accounting firms, or public institutions.
6. Transfers of data outside the EU: information about any transfers to third countries and the safeguards used.
7. Data-retention period: how long data will be stored, for example, a period required by law or the organization’s policy.
8. Description of technical and organizational measures: data safeguards such as encryption, pseudonymization, and access procedures.

What do you do with the record of processing activities?

1. Create and maintain it: the data controller creates the record and keeps it up to date.
2. Analyze and complete it: regularly check that all processing operations have been properly identified and described.
3. Update it: update the record whenever data-processing activities change, for example, when a new IT system is introduced or a processing purpose changes.
4. Review it during audits: use it during internal or external data protection audits.
5. Make it available to supervisory authorities: during an inspection, present the record to the supervisory authority, such as the President of UODO.
6. Use it for risk analysis: use the record as a basis for assessing processing risks and taking corrective action.

Who must keep a record of processing activities?

The data controller and the data processor must keep a record if:

• they employ 250 or more people, or
• they process personal data regularly, rather than only occasionally,
• they process sensitive data (for example, health data) or data relating to criminal convictions and offences.

Can AI support maintaining a record of personal data processing activities?

Artificial intelligence can improve how your organization maintains a record of personal data processing activities. AI may support this work in the following ways:

• Automating record updates: AI can track changes in data-processing activities so the record remains up to date. For example, it can detect changes in processing purposes or data categories and immediately update the relevant sections.
• Detecting non-compliance: AI algorithms can analyze the record and automatically detect inconsistencies or potential GDPR breaches. For example, if the record lacks information about processing purposes, AI can alert the controller.
• Managing risk: AI can help the organization monitor personal data processing risks, suggest corrective action, and adjust processes in real time to minimize the risk of a personal data breach.
• Generating reports: AI can automatically generate reports on GDPR compliance, including compliance with the requirement to keep a record of processing activities. These reports may help with internal and external audits.

Summary

A record of processing activities is part of GDPR documentation and is needed to demonstrate compliance. Its main purpose is to organize and monitor personal-data processes in the organization. Maintaining and updating it regularly helps support legal compliance, reduce breach risks, and prepare for possible inspections.

Using artificial intelligence in this process can automate and simplify record management and improve compliance monitoring.

If your company needs support creating, updating, or auditing a record of processing activities, contact our law firm.

Q&A: how to keep a GDPR record of processing activities

Who implements the record of personal data processing activities?

The company’s management board or a designated person, such as a data protection officer (DPO) or data protection team.

Where should the record of processing activities be kept?

In a secure location, such as a document management system, data protection software, or as a paper record in the data protection department.

How should the record of processing activities be made available?

Only to authorized people, through secure electronic systems or as a paper copy kept in an appropriately secure place.

Who should maintain the record under this procedure?

• Data Protection Officer (DPO): oversee the record’s completeness and currency.
• Department managers: provide information about processing activities in their areas.
• IT department: cooperate on recording technical aspects of data processing.
• Management board or its designees: approve and review the record for compliance.