adolfo-felix-546626-unsplash

Records of processing activities in GDPR Article 30

What do companies have to include in the records of processing activities?

GDPR requires companies to keep an internal record, which contains the information of all personal data processing activities carried out by the company.

According to the General Data Protection Regulation (GDPR) Art.30, records of processing activities must include significant information about data processing, including:

  • data categories,
  • the group of data subjects,
  • the purpose of the processing and
  • the data recipients.

This must be made available to authorities upon request.

Which companies are obliged to keep records of processing activities?

Each company who meets at least one of the following conditions has to keep a record of data processing activities: 

  • Processing personal data periodically (not occasionally).
  • Having more than 250 employees.. 
  • Processing any amount of sensitive and private data (concerning health, sexual orientation, racial or ethnic origin, political opinions, religious or philosophical belief, criminal records, etc.).

Also companies who carry out any of the following activities are obliged to keep the records: 

  • Evaluating work-related performance,
  • Monitoring individuals behavior, location and/or movements,
  • Providing insurance, investment, and financial services to private individuals,
  • Providing a loyalty schema (e.g. customer card) in a retail business,
  • Registering/collecting customer information,
  • Compiling the marketing profile of customers,
  • Providing rent services for recruitment or personnel,
  • Collecting people data related to gambling,
  • Collecting data related to children, the elderly, mentally ill persons,
  • Matching and combining personal data originated from various sources (big data),
  • Transmitting personal data outside the European Union (includes the cases the personal data is kept in servers located outside of EU).

How to store records of data processing activities?

It is important to know that all the records must be kept in an electronic form and be updated regularly. 

If your company is obliged to appoint a Data Protection Officer (DPO), then the DPO is responsible for keeping the records of processing activities. 

GOOD TO KNOW: 
There are several templates available at GDPR Register, which help to identify what information should be recorded about the data processing activities and how should it be structured. 

What exactly has to be documented?

If you are appointed as a Data Protection Officer (DPO) under the Article 37, you are obliged to document the following:

  • Your company’s name and contact details.
  • If applicable, the name and contact details of any joint DPO-s.
  • The purposes of the processing – why you use personal data (customer management, employment, marketing, sales).
  • The categories of individuals (e.g. employees, customers). 
  • The categories of personal data you process (e.g. contact details, health data). 
  • The categories of recipients of personal data (e.g. collaboration partners, third parties, tax department, university).
  • If applicable, the name of any third countries or international organisations that you transfer personal data to.
  • If applicable, the safeguards in place for exceptional transfers of personal data to third countries or international organisations.
  • If possible, the retention schedules for the different categories of personal data.
  • If possible, a general description of your technical and organisational security measures (e.g. encryption, employment training, access restrictions to contracts and other personal data).

Below you can see how to document your processing activities by using GDPR Register online platform.

GDPR Register - Processing Activities

Are you GDPR compliant?

Assess whether you have to comply with the GDPR in the first place and if you do, what is the level of preparedness of the GDPR compliance. Also check out the answers for the frequently asked questions.
Share on facebook
Share on google
Share on twitter
Share on linkedin
Share on pinterest
Share on print
Share on email

Subscribe to our Newsletter

Your e-mail address is only used to send you our newsletter and information about the activities of GDPR Register. You can always use the unsubscribe link included in the mail.

Latest Posts
First GDPR Fine Issued in Lithuania

First GDPR Fine Issued in Lithuania

A year after GDPR came into force, the Lithuanian Data Protection Authority (VDAI) has issued its first administrative fine. UAB ‘Mister Tango’,...
Finnish DPA ordered a company to change their data processing practises

Finnish DPA ordered a company to change their data processing practises

An article was published recently in the Helsingin Salomat about the Finnish Data Protection Authority who had ordered a payment and...
Data Protection Officer’s role and responsibilities

Data Protection Officer’s role and responsibilities

In light of the latest survey conducted by the CPO Magazine, we are looking into the role of the Data...
GDPR Compliance Checklist for 2019

GDPR Compliance Checklist for 2019

Just recently, a report was published based on a survey of 252 global privacy professionals working for a wide range...
Records of processing activities in GDPR Article 30

Records of processing activities in GDPR Article 30

What do companies have to include in the records of processing activities? GDPR requires companies to keep an internal record,...
GDPR in B2B Marketing

GDPR in B2B Marketing

There are two separate EU level regulations to follow when processing personal data for direct marketing in B2B and B2C...
Data Protection Impact Assessment Guide

Data Protection Impact Assessment Guide

The General Data Protection Regulation (GDPR) has introduced a new obligation, which requires companies and organizations to carry out data...
Cyber Attacks from the Perspective of GDPR: Ransomware

Cyber Attacks from the Perspective of GDPR: Ransomware

Nowadays almost every business sector integrates digital technologies. IT infrastructure and practice, if not updated regularly, ages and becomes weaker. Therefore,...
Six Months With GDPR in Force. What Happened?

Six Months With GDPR in Force. What Happened?

The GDPR, that came into force on the 25th of May, 2018, expanded the EU‘s data protection area coverage, introduced...
Healthcare sector: How to Comply With GDPR?

Healthcare sector: How to Comply With GDPR?

Since GDPR entered into force, the personal data protection has become more challenging to the Healthcare sector. Meaning that data...

Zpracovává vaše společnost osobní údaje?


Zpracovávat vaše společnost osobní údaje fyzických osob, jako jsou:

  • Údaje zaměstnanců, zákazníků, uchazečů o zaměstnání nebo pacientů včetně:
    • Jméno nebo osobní identifikační číslo
    • Kontaktní údaje (e-mailová adresa, telefonní číslo, adresa)
    • Bankovní údaje, plat, údaje o pasu nebo jiné osobní údaje

 

Ar Jūsų įmonė renka ir tvarko fizinių asmenų asmens duomenis? 


Asmens duomenys gali būti:

  • Kliento, darbuotojo. paciento, kandidato į darbo vietą ir kt. 
    • Vardas ar asmens  numeris 
    • Kontaktinė informacija (el.pašto adresas, telefono numeris, adresas ir kt)
    • Banko sąskaitos  duomenys, atlyginimo dydis, paso duomenys ar bet kokia kita asmeninė informacija. 

Onko yrityksessäsi enemmän, kuin 250 työntekijää?


Kas teie ettevõte kogub ja töötleb isikuandmeid?


Kas teie ettevõte kogub ja töötleb füüsiliste isikutega seotud andmeid nagu näiteks:

Töötajate, klientide, tööle kandideerijate, patsientide:

  • Nimi, isikukood
  • E-posti aadress, telefoninumber, kodune aadress
  • Pangakontonumber, palgasumma, krediitkaardiandmed või mõnda muut tüüpi isiklikud andmed

Does your company collect any personal data?


Does your company collect and process any personal data of natural persons such as:

  • Employees, Customers, Job Applicants or Patients including:
    • Name or personal ID number
    • Contact details (Email address, Phone number, Address)
    • Bank details, Salary amounts, Passport details or any other personal data