Most managing directors and HR leads in smaller companies know they are supposed to keep a record of processing activities. Fewer know exactly what belongs in it, and fewer still have one that would survive scrutiny. This is what it has to contain, and a template to start from.
Below: what is required, what is usually missing, and how to get there without hiring a lawyer. The record is also the natural first step in our practical GDPR guide for smaller companies.
What it is
A record of processing activities is internal documentation of how your company handles personal data. It is not a form you file with an authority. It is a living document that has to be available if IMY, the Swedish data protection authority, asks for it.
Every company with more than 250 employees must keep one. Smaller companies, which is most of them, must also keep one where the processing is not occasional, involves special category data, or could pose a risk to the people concerned. In practice that covers almost every company handling employee or customer data on a regular basis.
What goes in it
For each processing activity you document, the record should show:
Name and contact details of the controller, meaning your company, and of your data protection officer where you have one.
The purpose: why you process the data. “Marketing” is not enough. “Sending a newsletter to existing customers who have actively subscribed” is better.
Categories of data subjects: whose data this is. Employees, customers, suppliers, website visitors?
Categories of personal data: what you actually process. Name and email is one thing. Health data or personal identity numbers is another, and calls for a stronger justification.
Recipients: who sees the data, including external suppliers. Those are your processors, and each one needs a data processing agreement that holds up.
Transfers outside the EU: where data goes outside the EU and the EEA, a CRM with servers in the United States, for instance.
Retention: how long you keep the data and why.
Legal basis: why you are allowed to process it at all. The usual ones are contract, legal obligation, legitimate interest and consent.
The gaps we see most often
Commonly missing: candidate data from recruitment, processing in the finance and payroll systems, CCTV, and cookies and web analytics.
It is also common for retention periods to be missing or vague (“we keep it as long as we need it” will not do), and for the list of transfers outside the EU to overlook everyday SaaS tools such as Google Workspace, HubSpot or Slack, all of which handle data outside the EU.
Keeping it current
The record is not a project, it is a responsibility. Put a recurring slot in the calendar once a year, ideally tied to your business planning, and go through what has changed: new systems, new processing, new suppliers.
Give it an owner. Not “everyone”, one person responsible for keeping it accurate.
In short
A record of processing activities does not have to be complicated. It has to be accurate, complete and alive. Start with the obvious processing, employees, customers, invoicing, and build out from there. A half-finished record that is updated regularly beats a perfect document that was true three years ago.
Want to see how the rest of your documentation holds up? Take our Compliance Health Check for a position per area and a concrete picture of your gaps.
