YTYK You think you know

Card 16 of 18 Accountability ●○○ Foundational

Records of processing

Controllers and processors must keep records of processing activities — purposes, categories of data and recipients, transfers, retention periods, security measures — and produce them to the supervisory authority on request.

Why it is like this

Accountability needs an artefact. The record is the one document that makes every other duty checkable, which is why it is usually the first thing an inspection asks for.

Not to be confused with

Only for large organisations. The under-250-employee exemption is narrow: it falls away if the processing is not occasional, risks people's rights, or covers special categories — which is true of almost any business with employees and customers.

In practice

A processor's record is shorter than a controller's: it lists the controllers it acts for and the categories of processing, not the purposes, which are not its to set.

Source: Regulation (EU) 2016/679 (GDPR) — Article 30. Read on .

Predict Check yourself

A 40-person company processes customer and employee data continuously. Does the under-250 exemption spare it from keeping records?

  1. No — the exemption does not apply to processing that is not occasional, which continuous customer and HR data is.
  2. Yes — it is below the 250-employee threshold.
  3. Yes, provided it appoints a data protection officer instead.
  4. Only for the employee data, which is covered by labour law.
Show the answer

No — the exemption does not apply to processing that is not occasional, which continuous customer and HR data is.

The three carve-outs swallow the exemption for nearly everyone. Treating "fewer than 250" as the whole rule is the most common Article 30 mistake.