We are a small company with 20 employees. Do we have to keep a record too?

Paragraph 5 exempts organisations employing fewer than 250 persons, but with three exceptions. The exemption falls away if the processing is likely to result in a risk to the rights and freedoms of data subjects, if the processing is not occasional, or if it involves special categories of data under Article 9(1) or criminal data under Article 10. Because, for example, staff or customer administration is usually not occasional, in practice the obligation applies to many small organisations as well.

What exactly has to be in the record?

For the controller, paragraph 1 lists seven elements: contact details, purposes, categories of data subjects and data, categories of recipients, transfers outside the EU, where possible the retention periods and where possible a general description of the security measures. For the processor, the shorter list in paragraph 2 applies, per controller. The record may be kept digitally (paragraph 3).

Do I have to file the record somewhere?

No, you do not have to file it. Paragraph 4 says you make it available to the supervisory authority on request. Recital 82 explains that the record serves to demonstrate compliance and to help the supervisory authority monitor processing operations.

Article 30: Records of processing activities

Praxikon tracks Article 30 (Records of processing activities) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IVIn force since 25-05-2018

Article 30 requires organisations to keep a record of their processing activities: an overview of which personal data they process, why, about whom, to whom the data are disclosed and how they are secured. The controller keeps a record of the processing under its responsibility (paragraph 1), the processor a record of the categories of processing it carries out for each controller (paragraph 2). The record is kept in writing or electronically (paragraph 3) and must be made available to the supervisory authority on request (paragraph 4). The article exists because the GDPR expects organisations to be able to demonstrate compliance; recital 82 names the record as the means to do so and as the basis for supervision. Organisations with fewer than 250 employees are exempt, but that exemption falls away as soon as the processing is likely to result in a risk, is not occasional, or involves special categories of data or criminal data (paragraph 5).

Key term: Record of processing activities: the overview of all processing of personal data with which an organisation can show what it does with which data (paragraphs 1 and 2)

Directly affects:controllerprocessordata protection officersupervisory authority

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information: (a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer; (b) the purposes of the processing; (c) a description of the categories of data subjects and of the categories of personal data; (d) the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations; (e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards; (f) where possible, the envisaged time limits for erasure of the different categories of data; (g) where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

Each processor and, where applicable, the processor's representative shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing: (a) the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller's or the processor's representative, and the data protection officer; (b) the categories of processing carried out on behalf of each controller; (c) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards; (d) where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form.

The controller or the processor and, where applicable, the controller's or the processor's representative, shall make the record available to the supervisory authority on request.

The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

Record the seven elements of paragraph 1 for each processing activity: contact details, purposes, categories of data subjects and data, categories of recipients, transfers outside the EU, retention periods and a general description of security. Keep the record in writing or digitally (paragraph 3) and make sure you can produce it immediately if the supervisory authority asks for it (paragraph 4). If you have fewer than 250 employees, check whether one of the exceptions in paragraph 5 still obliges you.

Processor

Record for each controller which categories of processing you carry out on its behalf, with contact details of all parties, any transfers outside the EU and a general description of your security measures (paragraph 2). You too make the record available to the supervisory authority on request (paragraph 4).

Data Protection Officer

Your name and contact details appear in the record of the controller and of the processor (paragraph 1(a) and paragraph 2(a)). Check that those details are up to date.

Compliance checklist

A record of processing activities exists in writing or in electronic form (paragraphs 1 and 3).The record contains the name and contact details of the controller, any joint controllers, the representative and the data protection officer (paragraph 1(a)).For each processing activity the purposes, the categories of data subjects, the categories of personal data and the categories of recipients are recorded (paragraph 1(b), (c) and (d)).Transfers to a third country or international organisation are in the record, identifying that country or organisation and, for transfers under the second subparagraph of Article 49(1), the documentation of suitable safeguards (paragraph 1(e)).Where possible, the envisaged retention periods and a general description of the security measures under Article 32(1) are included (paragraph 1(f) and (g)).As a processor, the organisation keeps a record of the categories of processing carried out for each controller (paragraph 2).The record can be produced to the supervisory authority on request (paragraph 4).With fewer than 250 employees, it has been assessed and recorded whether one of the exceptions in paragraph 5 still requires a record.

Related recitals

(82)

In order to demonstrate compliance with this Regulation, the controller or processor should maintain records of processing activities under its responsibility. Each controller and processor should be ...

Cross-references

Art. 9: Processing of special categories of personal data Art. 10: Processing of personal data relating to criminal convictions and offences Art. 32: Security of processing Art. 49: Derogations for specific situations

Frequently asked questions

← Art. 29: Processing under the authority of the controller or processor Art. 31: Cooperation with the supervisory authority →

Connections

Themes where this returns

The counterpart in the other law

Analysis

Is an AI inventory register required? What the EU AI Act actually demands
2026-07-06