What really makes a record of processing activities useful: a role-based procedure

01

The short answer

A useful record always contains: the identity and contact details of the controller (and the DPO, if appointed), the purposes of each processing activity, the categories of data subjects and data, the recipients to whom the data are disclosed, any transfers outside the EU with documented safeguards, the envisaged erasure timeframes, and a description of the security measures applied.

02

Why these elements and not others

The GDPR distinguishes two records: the controller's, which tracks purposes and recipients, and the processor's, which lists the categories of processing carried out on behalf of each controller. Both must be kept in writing, including in electronic form, and made available to the supervisory authority on request. The obligation does not apply to organisations with fewer than 250 employees, unless the processing carries risks, is not occasional, or involves special categories of data.

03

The role-based procedure

Steps

1. The controller identifies each processing activity and records its purposes, categories of data subjects, and categories of data.
2. The controller documents the recipients of the data, including those in third countries, with the safeguards adopted.
3. The controller or the DPO estimates the erasure timeframes for each category of data, where possible.
4. The processor keeps a separate record of the categories of processing carried out on behalf of the controller.
5. The processor does not engage another processor without the controller's prior written authorisation, and each engagement is governed by a contract specifying subject matter, duration, nature, and purpose of the processing.

04

A hypothetical case

Hypothetical example: an SME with 180 employees uses an external cloud provider to manage payroll. The controller records the purpose (personnel management), the categories of data (pay data), and the recipient (the cloud provider). The provider, as processor, keeps its own record of the categories of processing carried out for that controller and operates on the basis of a written contract defining duration and nature.

05

Checks before considering the record complete

• Each processing activity has purposes, categories of data subjects, and categories of data indicated.
• Recipients, including any organisations in third countries, are listed with documented safeguards.
• Erasure timeframes are indicated where possible.
• Technical and organisational security measures are described in general terms.
• The record is in writing, including electronic form, and ready to be shown to the supervisory authority on request.

06

How software can support this procedure

A company can ask its software provider to configure a dedicated area where, for each processing activity, purposes, categories of data, and recipients are recorded, with a field tracking who entered or modified each entry. Assigning distinct roles to those who fill in the record (the controller or their delegate) and those who review it (the DPO, if appointed) supports the required traceability and makes it easier to show the record on request.

07

Frequently asked questions about the record's content

The controller's record and the processor's record have different content: the former focuses on purposes and recipients, the latter on the categories of processing carried out on behalf of the controller.

The 250-employee threshold does not automatically exempt an organisation from the obligation if the processing presents risks or involves special categories of data.

08

Next step

Steps

1. List all active processing activities in the company, one by one.
2. Assign an internal owner to each activity to keep it up to date.
3. Check that every entry contains all the elements required by Article 30.
4. Plan a periodic review together with the DPO, if appointed.