Records of Processing Activities (Article 30 GDPR)

Every controller and every processor maintains a record of its processing activities and makes it available to the supervisory authority on request (Article 30(1), (2) and (4) GDPR). The record is the central documentation instrument of the GDPR and the basis for the accountability obligation under Article 5(2) GDPR.

1 Overview

1.1 Function and purpose

The record replaces the general notification requirement under the former Data Protection Directive (Article 19 of Directive 95/46/EC), which was regarded as bureaucratic and of little benefit for data protection (Recital 89 GDPR). Its place is taken by internal documentation that the controller maintains on its own responsibility and discloses only on request from the supervisory authority (Recital 82 GDPR).

The record has three main functions:

• External supervision. Supervisory authorities use the record to obtain an overview of the systems and processes involving personal data and can carry out an initial assessment of lawfulness.
• Internal management. The record is the basis for the controller's self-monitoring, for a data protection management system and for adjacent obligations, such as the data protection impact assessment under Article 35 GDPR and the handling of data subject requests (in particular Article 15 GDPR).
• Demonstrating compliance. The record gives concrete shape to the accountability obligation under Article 5(2) GDPR.

1.2 Infringement and substantive lawfulness

An infringement of Article 30 GDPR is subject to administrative fines (Article 83(4)(a) GDPR). It does not, however, render the underlying processing unlawful: the documentation obligation must be distinguished from substantive lawfulness under Article 6 GDPR (CJEU, judgment of 4 May 2023, C-60/22, para. 61). A data subject's right to erasure or to restriction does not follow from the documentation infringement alone.

1.3 Addressees

The obligation is addressed to:

• the controller within the meaning of Article 4(7) GDPR (paragraph 1),
• the processor within the meaning of Article 4(8) GDPR (paragraph 2),
• in each case any representative under Article 27 GDPR.

The two obligations exist independently of one another. A body that processes data for its own purposes and at the same time acts as a processor for others (a typical situation in corporate groups) must maintain two records.

2 The controller's record (paragraph 1)

2.1 The concept of a processing activity

The term "processing activity" is not defined in law. It is process- and system-oriented and therefore broader than the notion of an individual processing operation in Article 4(2) GDPR (Recital 82 GDPR). The German Data Protection Conference (DSK) describes a processing activity as a "business process at an appropriate level of abstraction" (DSK, Short Paper No. 1, p. 1). A processing activity may comprise several individual processing operations, for instance all processing enabled by a marketing tool.

2.2 Overview of the minimum content

Article 30(1), second sentence, GDPR lists seven items of minimum content:

The level of detail must permit a summary initial review by the supervisory authority; it need not reflect the controller's full state of knowledge.

2.3 Name and contact details (point a)

The mandatory details are the name and contact details of the controller, of any joint controller, of a representative and of the data protection officer. For companies, the registered business name is sufficient; the commercial register number or the competent local court need not be stated. Because Article 30(1)(a) uses the plural "contact details", a mere email or web address is not enough. The supervisory authorities require a triad: postal address, telephone number and electronic contact details (DSK, Guidance on the records of processing activities, p. 4).

They also recommend naming, instead of the statutory representatives, the operational contact person who is responsible for the processing in day-to-day business (DSK, op. cit., p. 4). In corporate groups, this information also shows which company is specifically responsible; naming the organizational unit responsible for the subject matter is customary, but not required by law.

2.4 Purposes (point b)

What must be stated is the purpose context of each processing operation. The level of detail is not laid down in the law; the benchmark is the information obligations under Articles 13 and 14 GDPR. The degree of differentiation must satisfy two requirements: unambiguous distinction between the procedures and the possibility of a summary review. The more critical a processing operation is (for instance because it triggers a data protection impact assessment), the more precise the description must be.

Granularity is a matter of judgment: the individual steps of payroll accounting (calculation of wages, payment instruction, payment control) are not each listed separately. Typical processing operations that appear in a carefully maintained record include employee master data, time recording, payroll accounting, training and performance management, applicant administration, video surveillance, document and file management, physical access and system access control, email communication, employee directories, CRM, accounting and receivables management, ERP, travel booking and expense accounting, and project management.

2.5 Categories of data subjects and of data (point c)

The categories of persons follow from the particular procedure: customers, suppliers, employees, applicants, managers, prospective customers, commercial agents, contractual partners, borrowers, guarantors, patients or physicians. Categories based on specific criteria (income or age groups) are also possible where those criteria are themselves the subject of the processing. The description must make the group of persons clearly delimitable; blanket umbrella terms such as "external parties" are not sufficient.

The categories of data must be assigned to the respective categories of persons, for example identification and address data, contract master data, contract billing and payment data, planning and control data, credit reference data and IT usage data. Special categories of personal data under Article 9 GDPR must be marked as such, because additional obligations attach to them (see Article 9).

2.6 Categories of recipients (point d)

The record must include the categories of recipients (Article 4(9) GDPR) to whom the data have been or will be disclosed, including recipients in third countries and international organizations. "Disclosure" is broader than "transmission" and also covers passive access rights, irrespective of whether the recipients actually make use of them. Bundling by function is permissible, for instance "logistics service providers" or certain types of processors.

Only intended disclosures are covered. An accidental disclosure resulting from incorrectly configured permissions is not an entry in the record but a personal data breach within the meaning of Article 33 GDPR.

2.7 Transfers to third countries (point e)

Where data are transferred to a third country (that is, a non-EU state) or to an international organization, the record must state the name and, where applicable, further identifying information. Where the transfer is based on one of the derogations in Article 49(1), second subparagraph, GDPR, the suitable safeguards must additionally be documented. When such a data export exists and which safeguards come into consideration is dealt with in the chapter Transfers to third countries (data export).

2.8 Time limits for erasure (point f)

"Where possible", the envisaged time limits for erasure of the different categories of data must be stated. This qualifying wording takes account of the fact that rigid time limits for entire categories are rarely appropriate: within the same category, individual types of data may trigger very different retention obligations, for example under § 257 of the German Commercial Code (HGB), § 147 of the German Fiscal Code (AO) or sector-specific legislation.

In practice, it is advisable to define the earliest start and the latest end of the period in each case or, alternatively, to store an erasure rule anchored to a firmly defined event. Recital 39, tenth sentence, GDPR expressly permits time limits for erasure or for periodic review. Specific erasure periods belong in the erasure concept in any event; the record is the place where they become centrally traceable (see storage limitation).

2.9 Technical and organizational measures (point g)

"Where possible", a general description of the technical and organizational measures referred to in Article 32(1) GDPR must be included. What is required is not a detailed data security concept, but a summary overview in keyword form that allows the supervisory authority to make an initial assessment of the level of protection.

2.10 Addition under the AI Act (Article 10(5)(f) AI Act)

Where providers of high-risk AI systems process special categories of personal data for the purpose of detecting and correcting bias, they must additionally give reasons in the record under Article 30 GDPR why that processing was strictly necessary and why the objective could not be achieved by other categories of data (including synthetic or anonymized data) (Article 10(5)(f) of Regulation (EU) 2024/1689). To that extent, the minimum content required by Article 30(1), second sentence, GDPR is extended.

3 The processor's record (paragraph 2)

3.1 Separate obligation

The processor, too, maintains its own record, kept separately for each client on whose behalf it acts. The obligation is independent and not subsidiary to the controller's obligation. The processor's record serves both the processor's own self-monitoring and, indirectly, monitoring by the controller. A body in a dual role maintains two separate records.

3.2 Mandatory details

The minimum content is narrower than for the controller (Article 30(2)(a) to (d) GDPR):

• point a: identification. Name and contact details of the processor and of each controller on whose behalf processing is carried out; where applicable, the representative and the data protection officer of both sides. The aim is swift and unambiguous identification of the contact person. In mass business (typically cloud computing with a standardized offering for a large number of customers), it is widely accepted that stating categories of controllers initially suffices, provided that a specific list can be supplied at the supervisory authority's request.
• point b: categories of processing per client. Bundling of similar processing operations is permissible: the individual processing operations are set out in the record of the respective controller. This avoids redundancies. In the case of standardized cloud services, comparable assignments may be combined into a single category; the aim is to be able to assess the risk profile of the processing.
• point c: transfers to third countries. Identical in content to paragraph 1, point e (see 2.7).
• point d: technical and organizational measures. "Where possible", a general description of the measures referred to in Article 32(1) GDPR (see 2.9).

4 Form and making available (paragraphs 3 and 4)

4.1 In writing or in electronic form

The record must be maintained in writing, and an electronic format is expressly sufficient (Article 30(3) GDPR). Strict written form with signatures of the responsible officers is not required; text form within the meaning of § 126b of the German Civil Code (BGB) is sufficient. An electronic signature is likewise not required. The market offers a range of applications that differ in functionality and suitability for corporate groups. A comparison before making a selection is advisable.

4.2 Language

The law does not prescribe a language. The German supervisory authorities refer to § 23(1) and (2) of the German Administrative Procedure Act (VwVfG) and require the record to be kept "as a rule in the German language", but at least require that a translation can be provided without undue delay (DSK, Guidance on the records of processing activities, p. 3). Internationally active groups may therefore maintain a single English-language record and, in an individual case, have the description of the specific processing activity requested translated.

4.3 Making available on request

There is no obligation to submit the record ex officio, nor any obligation to publish it. The record must be made available to the supervisory authority only on request (Article 30(4) GDPR). Electronic transmission (for example via guest access to the application used) is permissible; as a precaution, an analogue form should also be kept available.

5 Exemption for smaller enterprises (paragraph 5)

5.1 Rule and exception

Enterprises and bodies with fewer than 250 employees are in principle exempt from the obligation to maintain a record (Article 30(5) GDPR). What matters is the absolute number of employees of the enterprise, not the number of employees involved in the processing. The background is Recital 13 GDPR: the free movement of data within the internal market must not burden small and medium-sized enterprises with disproportionate administrative effort.

5.2 Counter-exceptions

The exemption applies, however, only if none of the following situations is present. As soon as one of them applies, the obligation to maintain a record revives:

• the processing entails a risk to the rights and freedoms of the data subjects,
• the processing is not occasional,
• special categories of data within the meaning of Article 9(1) GDPR are processed, or
• personal data relating to criminal convictions and offenses within the meaning of Article 10 GDPR are processed.

5.3 Interpretation of the indeterminate concepts

Both key concepts are contested:

• "Risk" does not mean every abstract possibility of an adverse effect. Otherwise the exception would be devoid of substance, because every processing operation entails a risk in principle. What must be meant is a high or substantial risk to the rights and freedoms of the data subjects.
• "Not occasional" is not to be understood in purely temporal terms. The English language version of the GDPR uses the word "occasional", which points to subordinate significance overall rather than to mere frequency. The Commission's draft already sought to exempt processing carried out "only as an ancillary activity in addition to its main activities"; Recital 13 GDPR was not adapted in the course of the procedure. The exemption therefore ceases to apply only where the processing forms part of the core business. Regular payroll accounting for a company's own workforce, by contrast, does not yet make the processing "not occasional"; otherwise the threshold of 250 employees would be meaningless.

5.4 The Commission's reform proposal (COM(2025) 501 final)

In May 2025, as part of its simplification package, the European Commission presented a proposal to recast paragraph 5 (COM(2025) 501 final; for the technical assessment see the EDPB/EDPS opinion). Three changes are planned:

• raising the threshold from 250 to 750 employees,
• a uniform criterion for the counter-exception: processing that is likely to result in a high risk within the meaning of Article 35 GDPR,
• processing of special categories of personal data in the employment context under Article 9(2)(b) GDPR would no longer automatically trigger the obligation.

The proposal has not yet been adopted; the version of Article 30(5) GDPR currently in force continues to apply.

In practice, the scope of the exemption is narrow: anyone falling below the employee threshold will almost always come within at least one of the counter-exceptions. In addition, the information needed for the record (purposes, categories of data, recipients, erasure periods, protective measures) has to be kept available for compliance with other GDPR obligations in any event, for instance for the information obligations under Articles 13 and 14 GDPR, the right of access under Article 15 GDPR and data security under Article 32 GDPR. The additional effort involved in maintaining a record therefore remains manageable.

6 Structure, maintenance and internal responsibility

6.1 Who maintains the record within the organization?

The law is silent on internal responsibilities. Externally, the controller remains the addressee of the obligation; in practice, however, preparation of the record is regularly assigned to the data protection officer. This task is not part of the statutory list of tasks in Article 39 GDPR; delegation by management is permissible, provided that the data protection officer remains free from instructions as regards the substance (Article 38(3) GDPR).

In practical terms, the data protection officer assumes an organizational role comparable to that of a project manager. He or she cannot gather the detailed information alone, but depends on the cooperation of the respective process owners, who are responsible for the business process in substance and who supply the necessary information on purposes, categories of data, recipients, erasure periods and protective measures. Responsibility for completeness and accuracy remains unaffected by this and lies with the controller, not with the data protection officer.

6.2 Preparation in two steps

For the initial preparation, a two-stage approach has proven effective:

6.3 Updating

The law does not provide for an express obligation to update; the corresponding proposal by the Parliament was rejected in the legislative procedure. The obligation nevertheless follows from the verb "maintain" and from the accountability obligation (Articles 5(2) and 24 GDPR): a record that does not reflect the current state of the processing operations does not fulfill its purpose. It is to be understood as a living document.

In practical terms, it makes sense to establish a process in which the person responsible for a business process or a system is asked at regular intervals to confirm that the record is up to date, incorporates changes and documents them in a change history. The supervisory authorities recommend keeping the change history for at least one year so that adjustments remain traceable (DSK, Guidance on the records of processing activities, p. 3).

6.4 Corporate group constellations

In groups of undertakings (Article 4(19) GDPR), it is natural to maintain the record centrally and to grant subsidiaries read-only access. Where central IT systems or shared services are used across the group, an intercompany agreement with a dynamic reference to the record can prevent every change of tool from triggering an amendment to the contract. The individual responsibilities and recipients must nevertheless be named precisely in the record itself.

6.5 Relationship to other obligations

The record is a point of reference for a number of further obligations:

• it gives concrete shape to the accountability obligation (Article 5(2) GDPR),
• it provides the starting point for the data protection impact assessment under Article 35 GDPR,
• it is the basis for responding to requests for access under Article 15 GDPR,
• it complements the documentation under Article 24 GDPR and the information security management system under Article 32 GDPR,
• in conjunction with Article 10(5) of the AI Act, it carries additional justifications for the processing of special categories of data for bias correction in high-risk AI systems.