Record of processing activities
Record of processing activities is a written description of organisations personal data processing.
The obligation to draw up a record of processing activities applies to all organisations with more than 250 employees. Smaller organisations are also required to draw up the record if
- the personal data processing for which the organisation is responsible is likely to pose a risk to the rights and freedoms of data subjects
- the organisation's processing of personal data is not occasional or
- the organisation processes special categories of data, or personal data relating to criminal convictions and offences.
The record is intended for the organisation's own use
The record is an internal document. It helps in creating an overall picture of the processing of personal data and, for its part, demonstrates that the personal data are being processed in accordance with data protection legislation. Indeed, the record is an integral part of demonstrating the organisation's accountability.
If necessary, the supervisory authority can use the record to evaluate the legality of the processing activities. For this reason, the record must be delivered to the supervisory authority upon request.
Data subjects must be informed of the processing of their personal data as indicated in the instructions concerning communication. The record of processing activities is not intended for informing the data subjects directly, but can be used in producing the information to be communicated to the data subjects.
What information is required in the record?
The Office of the Data Protection Ombudsman has drawn up a template for the record. There are separate templates for controllers and processors. The template is a voluntary tool for drawing up records of processing activities; its use is not mandatory.
Organisations can draw up the record in the manner they deem appropriate, as long as the required information is indicated clearly. The information that controllers and processors must state in the record is described below.
Read more:
Controller's record of processing activities
Processor's record of processing activities