Records of processing activities: what elements make them truly useful

01

The short answer

A record of processing activities becomes a useful tool when it brings together, for each activity, the elements set out by Regulation (EU) 2016/679: the name and contact details of the controller, any joint controllers, the controller's representative, and the data protection officer; the purposes of the processing; the categories of data subjects and personal data; the categories of recipients, including those in third countries; any transfers outside the EU with the safeguards applied; the retention periods, where possible; and a general description of the technical and organizational security measures adopted.

02

Who keeps it and in what form

The obligation applies both to the controller, who records the activities carried out under its own responsibility, and to the processor, who keeps a separate record of the categories of processing carried out on behalf of each controller. The relationship between the two is governed by a contract or other legal act setting out the subject matter, duration, nature, and purpose of the processing. The record must be kept in writing, including in electronic form, and businesses with fewer than 250 employees may be exempt, unless there are risks to data subjects, the processing is not occasional, or it involves special categories of data.

03

How to build it step by step

Steps

1. List every processing activity, identifying the controller, any joint controllers, the controller's representative, and the data protection officer.
2. Describe the purpose of each processing activity and the categories of data subjects and data involved.
3. Indicate the categories of recipients, including those in third countries or international organizations.
4. Document transfers outside the EU and the adequate safeguards applied, if any.
5. Note the planned retention periods and the technical and organizational security measures adopted.

04

A hypothetical example

Hypothetical example: a company with forty employees maps the processing of staff data. The record shows the controller and its contact details, the purpose (managing the employment relationship), the categories of data subjects (employees) and data (contract and payroll data), the recipients (external payroll consultant), the absence of transfers outside the EU, a retention period linked to the duration of the employment relationship, and the security measures applied, such as encryption of digital archives.

05

Checklist of the required elements

• Name and contact details of the controller, any joint controllers, the controller's representative, and the data protection officer.
• Purposes of processing described for each recorded activity.
• Categories of data subjects and personal data processed.
• Categories of recipients and, where applicable, transfers to third countries with the safeguards adopted.
• Retention periods, where possible, and technical and organizational security measures.

06

Setting it up with a software partner

A business can choose to rely on a software partner for the information structure that supports the record: a single list of processing activities, with fields for controller and processor, contacts, categories of data subjects and data, recipients, transfers, retention periods, and security measures. Assigning roles and edit permissions only to those who revise the record, and keeping a history of revisions over time, are operational choices that keep the record consultable and consistent with the obligation to keep it in writing, including in electronic form.

07

Frequently asked questions

• The record can be kept in electronic form, not only on paper.
• Businesses with fewer than 250 employees may be exempt, unless there are risks to data subjects' rights or special categories of data are involved.
• On request, the record must be made available to the competent supervisory authority.

08

The next useful step

List the processing activities already underway in your business and check, one by one, whether all the required elements appear: contacts, purposes, categories, recipients, transfers, retention periods, and security measures. This check makes it possible to quickly identify what is missing and complete the record with verifiable data.