Records of Processing Activities
Article 30 of the GDPR requires controllers and processors to maintain records of processing activities under their responsibility. This is a key accountability measure demonstrating compliance with the GDPR.
Who Must Maintain Records?
Both controllers and processors must maintain records, except for:
- Organizations with fewer than 250 employees, UNLESS:
- The processing is likely to result in a risk to individuals' rights and freedoms
- The processing is not occasional
- The processing includes special categories of data or criminal conviction data
In practice, most organizations need to maintain these records.
Controller Records Requirements
Controllers must document:
- Name and contact details of the controller, joint controllers, controller's representative, and DPO
- Purposes of processing
- Categories of data subjects (e.g., customers, employees)
- Categories of personal data (e.g., names, addresses, payment details)
- Categories of recipients to whom data has been or will be disclosed
- Details of transfers to third countries including documentation of appropriate safeguards
- Retention schedules - time limits for erasure of different categories of data
- Technical and organizational security measures (general description)
Processor Records Requirements
Processors must document:
- Name and contact details of the processor, each controller on behalf of which the processor is acting, processor's representative, and DPO
- Categories of processing carried out on behalf of each controller
- Details of transfers to third countries including documentation of appropriate safeguards
- Technical and organizational security measures (general description)
Format and Accessibility
Records must be:
- In writing (electronic format is acceptable)
- Made available to the supervisory authority upon request
- Kept up to date
- Comprehensive and accurate
Benefits of Maintaining Records
Well-maintained records help organizations:
- Understand and map their data processing activities
- Identify and address compliance gaps
- Respond efficiently to data subject requests
- Demonstrate accountability and compliance
- Conduct DPIAs more effectively
- Identify where records management and security measures need improving