The record of processing activities documents which personal data a company processes and for what purpose.
Significance
It is the central mandatory documentation under Art. 30 GDPR and the first thing examined in any audit by the authorities. An up-to-date record answers the question of which data is held where in the company.
Mandatory content
- name and contact details of the controller and of the data protection officer
- purposes of the processing
- categories of data subjects and of personal data
- categories of recipients
- transfers to third countries
- envisaged time limits for erasure
- general description of the technical and organisational measures
Processors must also keep their own record. The exemption for companies with fewer than 250 employees hardly applies in practice, because it does not cover processing that is not occasional.
Legal provisions
- Art. 30(1) GDPR
- Record kept by the controller.
- Art. 30(2) GDPR
- Record kept by the processor.
- Art. 30(4) and (5) GDPR
- Making the record available to the supervisory authority and exemptions.
Related terms.
Data protection officer (DPO) The data protection officer monitors compliance with data protection rules within an organisation and is the point of contact for the supervisory authority and data subjects. Art. 37 GDPR 
Technical and organisational measures (TOMs) Technical and organisational measures are the specific precautions a company takes to protect personal data. Art. 32 GDPR Deletion concept A deletion concept sets out in a binding manner which personal data is deleted when, how and by whom. Art. 5(1)(e) GDPR
All terms from A to Z Technical and organisational measures (TOMs) Technical and organisational measures are the specific precautions a company takes to protect personal data. Art. 32 GDPR Deletion concept A deletion concept sets out in a binding manner which personal data is deleted when, how and by whom. Art. 5(1)(e) GDPR 