{"id":3923,"date":"2025-03-31T12:25:05","date_gmt":"2025-03-31T12:25:05","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3923"},"modified":"2026-10-23T09:51:16","modified_gmt":"2026-10-23T09:51:16","slug":"processor-record-processing-categories-gdpr","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/processor-record-processing-categories-gdpr\/","title":{"rendered":"How to Create and Maintain a Processor’s Record of Processing Categories"},"content":{"rendered":"

The record of categories of processing activities is a document required by the GDPR (Article 30(2)). It applies to every company that processes personal data on behalf of a data controller. If you act as a processor, you must have the record, keep it up to date and make it available at the supervisory authority’s request. Below, you will find specific information on what the record contains, who keeps it, how to maintain it and where AI may help.<\/p>\n

What is a record of categories of processing activities?<\/h2>\n

A record of categories of processing activities<\/strong> is a document required by the GDPR<\/strong> (Article 30(2)). It applies to processors of personal data<\/strong><\/a>, meaning companies that process data on behalf of a data controller. It is equivalent to a record of processing activities<\/strong><\/a>, but it is kept by the processor rather than the controller.<\/p>\n

Keeping this record gives your company visibility into its data-processing operations and helps demonstrate GDPR compliance, both to the controller and to the supervisory authority, such as UODO, during an inspection or audit.<\/p>\n

What is the record of categories of processing activities for?<\/h3>\n
    \n
  1. Monitoring the processor’s activities<\/strong>: you document and monitor processing operations carried out on behalf of the data controller.<\/li>\n
  2. Processing transparency<\/strong>: you show which categories of data-processing activities your company carries out.<\/li>\n
  3. Ensuring GDPR compliance<\/strong>: you confirm that the rules are being followed. The record forms the basis of the processor’s accountability for carrying out the data-processing engagement.<\/li>\n
  4. Cooperation with the controller<\/strong>: the controller uses the record to assess how the processor performs its processing tasks.<\/li>\n
  5. Preparing for audits and inspections<\/strong>: this is a document you present to the supervisory authority, such as UODO, when requested.<\/li>\n
  6. Reducing risk<\/strong>: you identify possible non-compliance and reduce the risk of personal data breaches<\/strong><\/a>.<\/li>\n<\/ol>\n

    What does the record contain?<\/h2>\n

    Under Article 30(2) GDPR, the record of categories of processing activities should contain:<\/p>\n

      \n
    1. The processor’s name and contact details<\/strong>: information about the processor that keeps the record.<\/li>\n
    2. Data controllers<\/strong>: contact details for the controllers on whose behalf the processor processes personal data.<\/li>\n
    3. Categories of processing<\/strong>: a general description of the categories of processing carried out by the processor, such as archiving, IT-system support or processing employee data.<\/li>\n
    4. Transfers of data outside the EU<\/strong>: information about transfers of data to third countries and the safeguards applied.<\/li>\n
    5. Technical and organizational measures<\/strong>: a description of the safeguards used to protect data, such as encryption, pseudonymization<\/strong><\/a> and access controls.<\/li>\n<\/ol>\n

      What do you do with the record of categories of processing activities?<\/h2>\n
        \n
      1. Create and maintain it<\/strong>: as a processor, you must create the record and keep it up to date.<\/li>\n
      2. Update it<\/strong>: the record must reflect the current state of processing activities. Every change requires an update.<\/li>\n
      3. Make it available to supervisory authorities<\/strong>: a supervisory authority, such as UODO, may request the record during an inspection or audit.<\/li>\n
      4. Communicate with the controller<\/strong>: the record helps the controller monitor how your company performs its obligations.<\/li>\n
      5. Use it in audits<\/strong>: use it during internal compliance audits<\/strong><\/a> under the GDPR.<\/li>\n<\/ol>\n

        Who must keep the record?<\/h2>\n

        The obligation applies to processors<\/strong> of personal data that meet at least one of these conditions:<\/p>\n