The map without which nothing can be checked
The record of processing activities under Article 30 GDPR has a reputation as a tiresome formality. In fact it is the one place where an organisation writes down in full what it does with data – and thus the foundation of nearly every other duty.
Hardly any duty in the Regulation is deferred so reliably. The record produces no visible benefit, appears on no website, and nobody asks about it – until a supervisory authority writes. Then it is the first thing demanded, and not out of formalism: without that overview no other question can be answered.
That also explains why authorities almost always begin audits there. Anyone unable to write down which processing operations exist can neither justify a retention period, nor answer an access request in full, nor judge whether a breach is notifiable.
The exemption that frees almost nobody
Article 30(5) exempts organisations with fewer than 250 employees – and largely withdraws the exemption in the same sentence. It falls away as soon as the processing is likely to result in a risk to rights and freedoms, as soon as it is not occasional, or as soon as special categories under Article 9 are involved.
The second element disposes of the exemption in practice. A customer database, a payroll, a newsletter list: all regular processing and therefore not occasional. What remains is a very narrow band – an association keeping a participant list once a year and destroying it afterwards, say.
Does the duty to keep a record apply?
What belongs in it
Article 30(1) lists the mandatory particulars exhaustively. What is missing is notable: the legal basis. It does not appear in the list but belongs in every usable record – without it the lawfulness of a processing operation cannot be assessed, and that is exactly what gets asked. Most supervisory authorities therefore expect it expressly in their templates.
One entry from top to bottom
- Purpose of the processingSpecific enough for the reach to be recognisable – not "customer management" but what concretely happens.
- Categories of data subjects and of dataGroups, not individual cases. Special categories under Article 9 are marked separately.
- RecipientsProcessors too, including those in third countries – there with the transfer instrument.
- Erasure periodsIn periods where possible, otherwise as a criterion: "three years after the contract ends" rather than "as needed".
- Technical and organisational measuresA general description suffices; a reference to a separate security concept is enough.
The practical advice that follows from many audits is unspectacular: a brief, maintained record beats a detailed, outdated one. The Regulation demands written form and currency, not volume. A document describing thirty operations in five lines each and reviewed quarterly satisfies Article 30 completely – a hundred-page collection last amended three years ago does not.