The processing register: what it's for and how an external DPO keeps it up to date
·
Updated on ·
By 
Bertrand Bucelle · 6 min read
In brief
- The record of processing activities is a mandatory document (Article 30 of the GDPR) that lists all of an organisation's data processing activities: purposes, categories of data and data subjects, recipients, retention periods and security measures. The DPO keeps it up to date and it is the first document requested during a CNIL inspection.
What is the record of processing activities?
Required by Article 30 of the GDPR, the record lists all personal data processing activities of the organisation. It describes, for each processing activity: the purpose, the categories of data and data subjects, the recipients, the retention periods and the security measures.
Is it mandatory?
Yes, for almost all organisations. The partial exemption for organisations with fewer than 250 employees does not apply where processing is not occasional, involves sensitive data or presents a risk. In practice, almost everyone must maintain a record.
Why it's the cornerstone of an inspection
The record is generally the first document requested by the CNIL during an inspection. An up-to-date and complete record demonstrates your control over your processing activities and your good faith. An absent or outdated record is an immediate negative signal.
The processor's record
Processors (accounting firms, MSPs, SaaS providers) must maintain a record of processing activities carried out on behalf of their clients. This is a separate obligation from the controller's record of processing activities.
How an external DPO keeps it up to date
The DPO maps the processing activities, structures the record and updates it with each change (new tool, new processing activity, new processor). A dedicated platform automates this maintenance and generates an export ready for an inspection. This is Data Comply One's approach.
Take action
A record that's always up to date and exportable in one click: discover the Data Comply One platform.
Discover external DPO →Test my compliance for free