GDPR Article 30 requires controllers and processors to keep a written record of their processing activities and make it available to the supervisory authority on request. Organisations with fewer than 250 people are exempt only in limited cases, and the exemption disappears for risky, regular or special category processing.
What a controller must record
Article 30(1) lists these fields:
- Contact details of the controller, any joint controller, representative and data protection officer.
- The purposes of the processing.
- Categories of data subjects and categories of personal data.
- Categories of recipients, including those in third countries.
- Transfers to third countries, naming the country and, for certain transfers, the safeguards.
- Planned erasure time limits for each category, where possible.
- A general description of the technical and organisational security measures, where possible.
What a processor must record
A processor keeps a separate record of what it does for each controller: its own and each controller's contact details, the categories of processing, third country transfers with safeguards, and a general description of security measures. If you are a SaaS vendor handling customer data, this is your record.
The small organisation exemption
The duty does not apply to an organisation with fewer than 250 persons. But the exemption does not hold if the processing is likely to risk people's rights and freedoms, is not occasional, or involves special category or criminal offence data. A company that processes customer accounts every day is not doing so occasionally, so most software firms should assume they need a record.
A layout that stays alive
Use one row per processing activity, such as "customer billing" or "support ticketing". Columns:
- Activity name and owner.
- Purpose and lawful basis.
- Data categories and people categories.
- System or vendor holding the data.
- Recipients and country of each.
- Transfer safeguard, if outside your region.
- Retention period.
- Security measures, linked to your control list.
- Last reviewed date.
The lawful basis column is useful practice even though Article 30 does not list it. It lines the record up with your privacy notice.
Keeping it accurate
Assign each row to a team lead, not to the privacy officer alone. Add a step to your release checklist: new vendor, new data field or new region means a record update. Review quarterly. Stale records are common, and an authority that asks for yours will compare it to reality.
Quick check
Must the record be on paper?
No. It must be in writing, which includes electronic form.
Is the record the same as a data map?
They overlap. A data map shows flows, while the record is the formal register. One can feed the other.
Safeguard's asset discovery and SBOM and dependency scanning help show which systems and third party components exist, which feeds the system column. They do not write the record for you.
Sources
Last reviewed: 19 October 2026.
