GDPR – Records of Processing Activities

Article 30 requires controllers and processors to keep a written record of their processing activities: what personal data they process, why, about whom, who receives it, where it goes, how long it is kept and how it is protected. The record must be shown to the supervisory authority on request. In the four Article 30 cases published on this site, Deliveroo, Foodinho and Volkswagen had records that were found deficient; IAB Europe had kept no record for the processing at issue.

Which Articles Govern Records of Processing

Who Must Keep a Record

Every controller and processor, unless the Article 30(5) exemption applies. That exemption is narrower than it looks. The Article 29 Working Party’s position paper, endorsed by the EDPB, confirms that the three conditions are alternatives: any one of them triggers the obligation. For an organisation with fewer than 250 employees, that means a record is required for any activity that:

• Is likely to result in a risk to the rights and freedoms of data subjects
• Is not occasional
• Includes special category data (Art. 9(1)) or criminal conviction and offence data (Art. 10)

The small organisation only has to record those activities, not all of its processing. The position paper treats regular processing such as HR data as not occasional, so an organisation that regularly processes employee data needs a record for that processing.

What a Controller’s Record Must Contain

Article 30(1) sets the minimum content:

• The name and contact details of the controller and, where applicable, the joint controller, the controller’s representative and the data protection officer
• The purposes of the processing
• The categories of data subjects and of personal data
• The categories of recipients, including recipients in third countries or international organisations
• Where applicable, transfers to a third country or international organisation, identifying the destination, and for transfers under the second subparagraph of Art. 49(1), the documented safeguards
• Where possible, the envisaged time limits for erasure of each category of data
• Where possible, a general description of the technical and organisational security measures under Art. 32(1)

In the Deliveroo case, the Garante found that a flat six-year storage period had been set instead of periods appropriate to each purpose, and cited Article 30(1)(c), (f) and (g).

What a Processor’s Record Must Contain

Article 30(2) requires a separate record, kept by the processor, covering:

• The name and contact details of the processor, each controller it acts for, any representatives and the data protection officer
• The categories of processing carried out on behalf of each controller
• Where applicable, transfers to a third country or international organisation, with the same identification and documentation as for controllers
• Where possible, a general description of the technical and organisational security measures

A processor’s record does not state purposes or retention, which belong to the controller. An organisation can be both, for example a controller for its own HR data and a processor for client data. It then needs both records.

How the Record Supports Other Obligations

The record is the starting point for several other GDPR duties. A DPIA must begin with a systematic description of the processing (Art. 35(7)(a)). Transfers to third countries must be identified in the record (Art. 30(1)(e)). Much of what a privacy notice must disclose under Articles 13 and 14, such as purposes, recipients, transfers and retention, overlaps with what the record contains.

Proposed Changes and EDPB Templates

On 21 May 2025, the Commission proposed, as part of the Omnibus IV simplification package, a regulation that would extend the Article 30(5) exemption to small mid-cap enterprises and organisations with fewer than 750 employees, unless their processing is likely to result in a high risk. The EDPB and EDPS welcomed the simplification and asked for clarifications.

On 9 June 2026, the Council and Parliament reached a provisional agreement on the small mid-cap legislation, raising the small mid-cap definition to fewer than 1,000 employees and either up to €200.000.000 turnover or €172.000.000 balance sheet total. The Council’s announcement does not set out the agreed wording of Article 30(5). The agreement must still be endorsed, revised and formally adopted; at the time of this review we found no publication in the Official Journal. Until the amending regulation applies, the current Article 30(5) applies.

Separately, a record of processing activities template was listed first among the templates contributors most wanted in the EDPB’s November–December 2025 consultation, and the EDPB’s 2026–2027 work programme includes developing one.

Real Cases

In each case, the Article 30 finding sat alongside breaches of other articles.

See all records of processing cases →

Recitals That Explain This Issue

Checklist

• Decide whether you are a controller, a processor or both, and keep a separate record for each role
• If you have fewer than 250 employees, check each activity against the three Art. 30(5) conditions; any one requires a record for that activity
• Record each purpose separately rather than grouping several under one generic entry
• Match the categories of data to what systems actually collect, including data generated by algorithms, devices or tracking
• Set a retention period, or the criteria for one, per category of data rather than one period for everything
• Identify each third-country destination and its transfer tool
• Keep the security description current as systems change
• Check that your privacy notice, DPIAs and record describe the same processing
• Be able to produce the full, current record promptly when the supervisory authority asks