{"id":3925,"date":"2025-03-31T11:35:52","date_gmt":"2025-03-31T11:35:52","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3925"},"modified":"2026-10-23T09:50:42","modified_gmt":"2026-10-23T09:50:42","slug":"gdpr-record-processing-activities","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/gdpr-record-processing-activities\/","title":{"rendered":"How to Keep a GDPR Record of Processing Activities"},"content":{"rendered":"

A record of processing activities is a document required by the GDPR (Article 30) in which you record all processes involving personal data in your organization. Without it, you cannot demonstrate compliance; during an inspection by UODO, you will have nothing to present. This guide explains what the record contains, who keeps it, how to update it, and where AI may help.<\/p>\n

In earlier articles in the GDPR series, I discussed the importance of managing records of authorizations to process personal data<\/a><\/strong> and whether people can be authorized to process personal data<\/a><\/strong>. These matters are closely connected to maintaining the record: each processing activity should be properly documented and access to it controlled.<\/p>\n

What is a record of processing activities?<\/h2>\n

A record of personal data processing activities is required by the GDPR (Article 30). Its main purposes are to:<\/p>\n

    \n
  1. Record data-processing activities<\/strong>: track how data is collected, stored, and used.<\/li>\n
  2. Ensure GDPR compliance<\/strong>: provide evidence of compliance with personal data protection rules.<\/li>\n
  3. Identify risks<\/strong>: enable analysis and assessment of risks associated with individual processing operations.<\/li>\n
  4. Promote transparency<\/strong>: make it easier to oversee all personal-data activities in the organization.<\/li>\n
  5. Assist with audits and inspections<\/strong>: the record is part of the documentation made available to supervisory authorities, such as UODO, during an inspection.<\/li>\n
  6. Manage data<\/strong>: help optimize processing operations and improve personal data protection.<\/li>\n<\/ol>\n

    What does a record of processing activities contain?<\/h2>\n

    Under Article 30 GDPR, the record should contain the following information:<\/p>\n

      \n
    1. Data controller details<\/strong>: the name and contact details of the controller or joint controllers.<\/li>\n
    2. Purposes of processing<\/strong>: clearly defined reasons for processing data, such as performing a contract, marketing, or recruitment.<\/li>\n
    3. Categories of data subjects<\/strong>: for example, employees, customers, and business partners.<\/li>\n
    4. Categories of personal data<\/strong>: the types of data collected, such as first name, surname, email address, or telephone number.<\/li>\n
    5. Data recipients<\/strong>: entities to which data is transferred, such as IT companies, accounting firms, or public institutions.<\/li>\n
    6. Transfers of data outside the EU<\/strong>: information about any transfers to third countries and the safeguards used.<\/li>\n
    7. Data-retention period<\/strong>: how long data will be stored, for example, a period required by law or the organization\u2019s policy<\/a><\/strong>.<\/li>\n
    8. Description of technical and organizational measures<\/strong>: data safeguards such as encryption, pseudonymization, and access procedures.<\/li>\n<\/ol>\n

      What do you do with the record of processing activities?<\/h2>\n
        \n
      1. Create and maintain it<\/strong>: the data controller creates the record and keeps it up to date.<\/li>\n
      2. Analyze and complete it<\/strong>: regularly check that all processing operations have been properly identified and described.<\/li>\n
      3. Update it<\/strong>: update the record whenever data-processing activities change, for example, when a new IT system is introduced or a processing purpose changes.<\/li>\n
      4. Review it during audits<\/strong>: use it during internal or external data protection audits<\/a><\/strong>.<\/li>\n
      5. Make it available to supervisory authorities<\/strong>: during an inspection, present the record to the supervisory authority, such as the President of UODO.<\/li>\n
      6. Use it for risk analysis<\/strong>: use the record as a basis for assessing processing risks and taking corrective action.<\/li>\n<\/ol>\n

        Who must keep a record of processing activities?<\/h2>\n

        The data controller<\/strong> and the data processor<\/a><\/strong> must keep a record if:<\/p>\n