To prove UK GDPR compliance, keep a written record of processing activities under Article 30, plus the documents it points to: privacy notices, consent records, processor contracts, data protection impact assessments, breach records and retention schedules. The ICO says records must be in writing, granular and kept up to date.
Who has to keep records?
The ICO's guidance states that controllers and processors each have documentation obligations. Organisations with 250 or more employees must document all their processing activities. Smaller organisations only need to document processing that is not occasional, could risk individuals' rights and freedoms, or involves special category or criminal offence data.
In practice, nearly any software company processes customer or user data continually, so the small organisation exemption rarely removes the duty. Assume you need the record.
What must the Article 30 record contain?
The ICO lists these items for controllers:
- name and contact details of your organisation, and where applicable other controllers, your representative and your data protection officer
- the purposes of the processing
- categories of individuals and categories of personal data
- categories of recipients
- transfers to third countries, with the transfer safeguards
- retention schedules
- a description of technical and organisational security measures
Processors have their own Article 30(2) list. If you act as both, keep two records.
What else should sit beside the record?
The ICO suggests linking, or keeping, documentation on information needed for privacy notices (lawful basis, legitimate interests, individuals' rights, automated decision making, data sources), records of consent, controller to processor contracts, the location of personal data, DPIA reports and records of personal data breaches. For special category or criminal conviction data, document the Data Protection Act 2018 condition you rely on, your lawful basis and whether you follow your retention and erasure policy document.
A constructed example
A 40 person analytics company hosts customer dashboards. As a processor for customer data, its Article 30(2) record names each customer as controller, lists the sub processors (cloud host, email service), lists the categories of data subjects its customers upload, records transfer mechanisms for the sub processors, and describes security controls. As a controller for its own marketing contacts, a second record gives the lawful basis, the retention period for unsubscribed contacts, and where the list is stored. The breach log is empty, which is itself stated: "no personal data breaches recorded in this period; reviewed monthly".
How do you build the record without a month of meetings?
The ICO recommends an information audit or data mapping exercise: questionnaires to teams, conversations with key functions, and review of policies, procedures, contracts and agreements covering retention, security and data sharing. Keep the result electronic so rows can be added and amended. Review regularly, since the guidance says records must reflect current processing.
What evidence do auditors and the ICO look at?
The ICO's data protection audit framework is an extension of its Accountability Framework, and describes areas it examines in consensual and compulsory audits. It notes that following the framework does not guarantee compliance, and that it is not directly applicable to small businesses, who should use the ICO's small business resources. The ICO page also notes the guidance is under review because of changes made by the Data (Use and Access) Act, so check for current versions before an audit.
Useful evidence beyond documents: dated review logs, training records, DPIA sign offs, access reviews for systems holding personal data, and tickets showing subject access requests handled in time.
What to do
- Decide your role per processing activity: controller, processor or both.
- Run a data mapping exercise and produce the Article 30 record in electronic form.
- Attach or link privacy notices, consent records, processor contracts and DPIAs.
- Keep a breach log, including entries that say none occurred.
- Add retention periods and deletion evidence, not only a policy.
- Schedule a review each quarter, and after any new product or vendor.
- Store security control evidence, such as access reviews and vulnerability scan history, beside the record.
- Check the ICO's current pages for updates under the Data (Use and Access) Act.
Safeguard's compliance automation can collect control evidence such as access and vulnerability management records. It supports your documentation. It does not certify compliance with UK GDPR.
Quick check
Do I need an Article 30 record if I have fewer than 250 staff?
Often yes. The exemption does not cover processing that is not occasional, risks individuals' rights, or involves special category or criminal offence data.
Must the record be electronic?
It must be in writing. The ICO says most organisations benefit from keeping it electronically so it is easy to update.
Sources
- Documentation, Guide to the UK GDPR, ICO, fetched 18 October 2026
- Data protection audit framework, ICO, fetched 18 October 2026
Last reviewed: 18 October 2026.
