Knowledge · GDPR · Article 30
Know every processing activity – in writing.
Controllers and processors must keep a record of their processing activities: what personal data, why, about whom, who receives it and how long it is kept. The record is kept in writing, including electronically, and made available to the supervisory authority on request.
What it requires
In plain words.
- The controller’s name and contact details, including any joint controller, representative and data protection officer
- The purposes of the processing and the categories of data subjects and personal data
- The categories of recipients, including in third countries, and any transfers with their safeguards
- Where possible, time limits for erasure and a general description of the security measures
- Processors keep a record of the processing they carry out for each controller
- Organisations with fewer than 250 employees are exempt only if the processing is occasional, unlikely to result in risk and excludes special categories of data
Plain-language summary of GDPR Article 30 (Regulation (EU) 2016/679). Not legal advice – read the official text on EUR-Lex.
In practice
What it takes.
The record goes stale the day a new system or supplier arrives. It has to be updated when processing changes – and reviewed regularly, with an owner.
- RegisterOne record per processing activity, in a structured format
- ProcessAn update on every change and a yearly review with an owner
- ContractsRecipients and processors linked to their data processing agreements
- EvidenceReview history and approvals kept with each record
How it runs in Paragraf – on the same foundation as your contracts and processes.
Next step
See GDPR article 30
with your own requirements.
Book a walkthrough. We show you the thread from this article to the Control, the owner and the evidence – in your own setup.