Creating a record of processing activities: what Art. 30 GDPR requires

What goes into a record of processing activities?

Each controller maintains a record of all processing activities under its responsibility (Art. 30(1) GDPR). The controller is your company, because it determines the purposes and means of the processing (Art. 4(7)).

It gives the name and contact details of your company and of any data protection officer. For each activity it states the purposes, the categories of data subjects and of personal data, and the categories of recipients. It adds transfers to third countries, naming the country, and, where possible, the time limits for erasure and a general description of the TOMs under Art. 32(1).

The record is kept in writing, which includes electronic form (Art. 30(3)). You make it available to the supervisory authority on request (Art. 30(4)); you do not have to publish it. If your company itself processes data on behalf of others, it keeps a second record for that under Art. 30(2).

Art. 4(7) · Art. 30(1) to (4) GDPR

Does the duty apply under 250 employees?

Art. 30(5) exempts organisations employing fewer than 250 persons “unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data”, such as health data, or data relating to criminal convictions and offences.

One of these conditions is enough. The DSK is the conference of Germany's federal and state data protection authorities. It names payroll and customer data management as processing that is not occasional, and it expects the exemption to apply only rarely.

On that reading, a company that runs payroll or maintains customer data regularly is not exempt. The German wording of paragraph 5 was corrected in 2016 (OJ L 314, 22.11.2016), so German quotes of the original version word the exemption differently.

Art. 30(5) GDPR

What is a processing activity? An example

The DSK generally treats a processing activity as a business process at a suitable level of abstraction. Each new purpose is a separate activity. Name it after its purpose, such as “payroll and salary accounting”. For the software, the DSK template has an optional field, “Name des eingesetzten Verfahrens” (name of the procedure used).

A made-up example: Muster Metall GmbH has 80 employees. Its entry “payroll” gives the purpose as paying wages, the data subjects as employees, and the data as master data, bank details and tax attributes. Recipients are the tax office, social insurance bodies and banks, plus the payroll software vendor where it processes the data in its cloud.

Under third countries it says “none”, because the DSK advises stating that explicitly too. The erasure time limit names the legal provision and when the period starts. For TOMs, the entry refers to the cryptography policy and the staff, access and asset policy from the NIS 2 walkthrough. The DSK expressly allows such references to information security documents.

Which mistakes to avoid in the record

A record that only lists software, such as “Microsoft 365” or “DATEV”, describes tools instead of purposes. One program often serves several activities, and one activity often uses several programs.

An entry such as “statutory retention periods” is a general reference, and in the DSK's view that is not enough: it asks for precise information. The European Data Protection Board (EDPB) recommends in its February 2026 report that the record state whether a legal obligation to retain the data exists.

A record goes out of date with every new program and every new service provider. The DSK recommends documenting changes and keeping that documentation for one year.

With an AI assistant: what it can prepare for the record

An AI assistant such as Claude, ChatGPT or Copilot can draft entries from your documents: your list of processes and software, suppliers and contracts. Through MCP (Model Context Protocol), an open standard, it also reads the NIS 2 walkthrough's lists. It covers the person's areas, and all records if an admin allows it and they may export.

Anything your documents do not state, such as a legal basis or an erasure time limit, is a suggestion in the draft. Whether an entry is correct and which time limit applies is for your company to decide as controller, with your data protection officer where one is designated.

Whatever you hand the assistant, such as payroll lists, its vendor processes too. Where the vendor acts as a processor, a contract under Art. 28(3) GDPR is required. A GDPR walkthrough on nisd2.eu is in the works, with the same MCP server as the NIS 2 walkthrough.

A request to the assistant can read like this:

Use get_walkthrough to read items 2.2 and 5.1. For every ticked process that involves personal data, draft an entry for the record of processing activities under Art. 30(1) GDPR, with purpose, data subjects, categories of data, recipients, third country, erasure time limit and TOMs. Flag every field the records do not state and leave it empty. Do not enter anything in the walkthrough.