How to Create and Maintain a Processor’s Record of Processing Categories

The record of categories of processing activities is a document required by the GDPR (Article 30(2)). It applies to every company that processes personal data on behalf of a data controller. If you act as a processor, you must have the record, keep it up to date and make it available at the supervisory authority’s request. Below, you will find specific information on what the record contains, who keeps it, how to maintain it and where AI may help.

What is a record of categories of processing activities?

A record of categories of processing activities is a document required by the GDPR (Article 30(2)). It applies to processors of personal data, meaning companies that process data on behalf of a data controller. It is equivalent to a record of processing activities, but it is kept by the processor rather than the controller.

Keeping this record gives your company visibility into its data-processing operations and helps demonstrate GDPR compliance, both to the controller and to the supervisory authority, such as UODO, during an inspection or audit.

What is the record of categories of processing activities for?

1. Monitoring the processor’s activities: you document and monitor processing operations carried out on behalf of the data controller.
2. Processing transparency: you show which categories of data-processing activities your company carries out.
3. Ensuring GDPR compliance: you confirm that the rules are being followed. The record forms the basis of the processor’s accountability for carrying out the data-processing engagement.
4. Cooperation with the controller: the controller uses the record to assess how the processor performs its processing tasks.
5. Preparing for audits and inspections: this is a document you present to the supervisory authority, such as UODO, when requested.
6. Reducing risk: you identify possible non-compliance and reduce the risk of personal data breaches.

What does the record contain?

Under Article 30(2) GDPR, the record of categories of processing activities should contain:

1. The processor’s name and contact details: information about the processor that keeps the record.
2. Data controllers: contact details for the controllers on whose behalf the processor processes personal data.
3. Categories of processing: a general description of the categories of processing carried out by the processor, such as archiving, IT-system support or processing employee data.
4. Transfers of data outside the EU: information about transfers of data to third countries and the safeguards applied.
5. Technical and organizational measures: a description of the safeguards used to protect data, such as encryption, pseudonymization and access controls.

What do you do with the record of categories of processing activities?

1. Create and maintain it: as a processor, you must create the record and keep it up to date.
2. Update it: the record must reflect the current state of processing activities. Every change requires an update.
3. Make it available to supervisory authorities: a supervisory authority, such as UODO, may request the record during an inspection or audit.
4. Communicate with the controller: the record helps the controller monitor how your company performs its obligations.
5. Use it in audits: use it during internal compliance audits under the GDPR.

Who must keep the record?

The obligation applies to processors of personal data that meet at least one of these conditions:

• they act on behalf of a data controller,
• they process personal data regularly, or
• they process sensitive data or data concerning criminal convictions.

If your company provides services involving the processing of another entity’s clients’ personal data, for example, IT support, accounting, hosting or HR, this obligation applies to you.

How AI can support maintaining the record

Artificial intelligence can reduce your team’s workload in several areas:

• Automatically updating the record: AI analyzes changes in data-processing operations and updates the record without manually entering every change. The record therefore always reflects the current state.
• Risk analysis: AI identifies areas where data protection needs improvement. Automatic risk detection allows corrective action to be taken sooner.
• Monitoring compliance: AI checks whether data-processing operations match the entries in the record and detects irregularities in real time.
• Generating reports: AI tools create reports on GDPR compliance and audit results, making it easier to document data-protection activities.

Summary

The record of categories of processing activities is a tool for processors of personal data. It documents processing operations carried out on behalf of a data controller and helps demonstrate GDPR compliance.

Three things to take care of:

• Keep the record up to date: every change in processing operations requires an update.
• Prepare for an inspection: the record must be ready to provide to the supervisory authority at any time.
• Consider automation: AI tools can simplify updating, monitoring and reporting.

If your company needs help managing this record, write to us. We can help organize the documentation and ensure GDPR compliance.

Read our article explaining what the GDPR is and watch the video in which attorney Mateusz Sawaryn explains why the GDPR was introduced.

Q&A: how to create and maintain a record of categories of processing activities

What does a record of categories of processing activities contain?

The record should contain the purposes of data processing, categories of personal data, categories of people whose data is concerned, data recipients, data-retention periods and the safeguards applied.

Does every company have to keep a record of categories of processing activities?

Yes. Every company that processes personal data must keep this type of record. It is a GDPR requirement, although there are certain exceptions, for example, for organizations with fewer than 250 employees.

What are the benefits of keeping a record of categories of processing activities?

Keeping the record supports GDPR compliance, increases transparency in data-processing operations, makes audits easier and helps identify areas where data protection needs improvement.