You can run a small GDPR program from four linked spreadsheets: a record of processing, a data subject request log, a breach log and a DPIA tracker. It works while volume is low. Automate when requests miss the one month deadline, the register goes stale, or vendors and systems multiply faster than reviews.
What must the spreadsheets hold?
Record of processing (Article 30). Controllers keep a record of processing activities, and processors keep their own version. For controllers, the article lists: contact details, purposes, categories of data subjects and personal data, categories of recipients, transfers to third countries and their safeguards, erasure time limits where possible, and a general description of security measures where possible. Organisations under 250 employees are generally exempt, but not if processing is likely to risk individuals' rights, is not occasional, or includes special category or criminal offence data. Most software companies fail that test and should keep the record.
Columns: activity, purpose, lawful basis, data categories, subjects, recipients, transfers, retention, owner, last reviewed.
Request log (Article 12). The controller must act on a request without undue delay and within one month of receipt, with a possible extension of two further months where necessary, and the person must be told of the extension within the first month with reasons. Responses are generally free, with narrow exceptions. Columns: received date, identity verified date, type, systems searched, due date, extension notice date, response date, outcome.
Breach log (Article 33). Controllers notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk individuals' rights. Late notice needs reasons. Processors tell the controller without undue delay. Every breach is documented, including facts, effects and remedial action. Columns: discovered, aware, assessed risk, notified authority, notified individuals, cause, fix.
DPIA tracker (Article 35). A DPIA is required before processing likely to result in high risk, and the article names automated evaluation with significant effects, large scale special category data and large scale monitoring of public areas. Contents include a description of the processing, necessity and proportionality, risks and measures. Columns: project, trigger, DPO advice date, risk summary, measures, review date.
Where does the spreadsheet approach strain?
The register is the first to rot, because it depends on engineers telling you about new processing. A column called "last reviewed" with dates two years old is a finding waiting to happen.
Requests are second. A request that touches six systems needs six searches, and a one month clock is short when the person who knows the system is on leave.
Breaches expose the weakness of any manual process: the 72 hour clock starts when you become aware, and nobody wants to find the right spreadsheet at 2 am.
When should you automate?
Move when you see more than a handful of requests a month, more than a dozen processors, regular product changes that add data, or any missed deadline. Automate discovery of what data and which vendors and libraries exist, deadline reminders, and evidence capture. Keep decisions, such as lawful basis and breach risk assessment, with people and your DPO if you have one.
What to do
- Create the four sheets with the columns above, and give each one an owner.
- Fill the processing record by interviewing each team lead, then confirm against system inventories.
- Add a rule that product changes touching personal data trigger a register update and a DPIA screening question.
- Build a request intake with a due date formula, and test it with a mock request.
- Draft a breach runbook that begins with the 72 hour clock and the notification content list.
- Review the register quarterly and record the date.
- Review the signs for automation each quarter.
Quick check
Does a small company need a record of processing?
The Article 30 exemption for under 250 employees does not apply if the processing is not occasional, risks individuals' rights or includes special category data. Many companies cannot rely on it.
What is the deadline for a data subject request?
One month from receipt, extendable by two months where necessary, with notice and reasons in the first month (Article 12).
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so repeating GDPR evidence can be collected from connected systems and code instead of by screenshot. Monitoring runs between reviews, which helps an inventory stay close to reality. Technical evidence from scans and SBOMs shows which third party libraries and services your software uses, a useful input to processor lists. Safeguard helps you prepare and keep evidence ready. It does not provide legal advice or make you compliant, and legal judgments stay with your counsel or DPO. See the framework mapping demo.
Sources
- GDPR Article 30, fetched 18 October 2026.
- GDPR Article 12, fetched 18 October 2026.
- GDPR Article 33, fetched 18 October 2026.
- GDPR Article 35, fetched 18 October 2026.
This is general information, not legal advice.
Last reviewed: 18 October 2026.
