Record of processing activities

The record can be organised around specific processing operations linked to a common basic purpose (e.g. “customer management”, “accounting management” or “human resources and payroll management”) or according to other criteria.

The APDCAT has developed a simple application for keeping the record of processing activities, which can be used by data controllers and processors who so wish.

In accordance with Article 30.5 of the GDPR, the obligation to keep the register does not apply to any company or organisation with fewer than 250 employees, unless the processing involves a risk to the rights and freedoms of data subjects, is not occasional, or includes the special categories of personal data referred to in Article 9, paragraph 1, or personal data relating to criminal convictions and offences referred to in Article 10.