PL EN
Book a meeting
Chapter 1Basic Compliance
  1. Chapter 1Basic Compliance
  2. Chapter 2Data Subject’s Rights
  3. Chapter 3Security
  4. Chapter 4Data Processing
  5. Chapter 5Managing Incidents and Data Breaches
  6. Chapter 6Data Protection Officer (DPO)
  7. Chapter 7The Regulator
  8. Chapter 8Legal Remedies, Liability, Administrative Sanctions
  9. Appendix IPersonal Data Protection Policy
  10. Appendix IIData Processing Agreement
  11. Appendix IIIJoint Controllership Agreement
Section 1.10
  1. 1.1The GDPR: The EU’s ‘Act’ on Personal Data Protection
  2. 1.2Material and Territorial Scope of the GDPR
  3. 1.3GDPR Glossary: Notes on Basic GDPR Terms, with Examples
  4. 1.4Personal Data Processing Principles
  5. 1.5Legal Basis for Personal Data Processing
  6. 1.6Articles 9 and 10 GDPR: Special Categories of Data and Data on Criminal Convictions
  7. 1.7Consent as Basis for Processing Personal Data
  8. 1.8The Controller and Processor
  9. 1.9Data Processing Which Does Not Require Identification
  10. 1.10Record of Data Processing Activities
  11. 1.11Transfer of Data to Third Countries or an International Organisation (Data Export)
  12. 1.12Cross-Border Processing, i.e. Competence of the Lead Supervisory Authority (Article 4(16) and (23), Article 56 GDPR)
  13. 1.13Joint Controllers
  14. 1.14Codes of Conduct and Certification (Article 40 Onwards of the GDPR)

Record of Data Processing Activities

Katarzyna Kloc, Maciej Gawronski, Marcin Dominiak, Michał Sztaberek, Patrycja Naklicka & Paweł Punda

#10.1 A Company’s Own Record Instead of Registration with a Supervisory Body

One of the fundamental obligations of organisations that process data, whether controllers or processors, is an obligation under Article 30 GDPR – to keep a record of all data processing activities.

Under Article 30(1) GDPR:

Each controller and, where applicable, the controller’s representative, shall maintain a record of processing activities under its responsibility.

Article 30(2) GDPR provides for a comparable obligation for processors.

The obligation to keep a record of personal data processing activities is a new data processing obligation. In the past, controllers were required to register their data filing systems with local supervisory bodies. During work on the reform of the EU personal data protection system, it was correctly concluded that this obligation led to ‘administrative and financial burdens and did not always help to improve personal data protection’ and was replaced with ‘effective procedures and mechanisms focused instead on those types of processing operations which are likely to result in a high risk to the rights and freedoms of natural persons by virtue of their nature, context and purposes’ (Recital 89 GDPR), i.e. among other things with a personal data impact assessment.

In order to keep a record of and organise in some way the kind of personal data that organisations process, and for what purpose and on what grounds, it is no longer necessary to register data filing systems with the supervisory authority, instead RDPAs do have to be maintained.

#10.2 Records of Data Processing Activities: Foundation for Accountability

The purpose of keeping a record of data processing activities is ensuring compliance with the GDPR. This is stated clearly in Recital 82 GDPR. A record of data processing activities is a form of documenting of data processing activities, acts as a data processing map and is one of the key elements enabling execution of the fundamental principle on which the entire personal data protection system is based, which is the principle of accountability. It also plays an informative role, for instance by providing the supervisory authority with information about data processing processes in a particular organisation.

#10.3 Data Processing Activities

In order to understand how a record of data processing activities should be approached from a practical point of view, first, it needs to be determined what a data processing activity is under the GDPR.

A ‘data processing activity’ is not a term defined in the GDPR, and this causes practical problems when trying to grasp what should be specifically referred to in the record of data processing activities and what should be recorded. Considering the legal definitions in the GDPR, a data processing activity is a separate term from general term ‘data processing’ or a ‘data filing system’ and ‘data processing operations’.

#10.4 Activities Performed for the Same Purpose

All of the commentaries and publications released to date on the subject of RDPAs emphasise that processing activities are: [1] operations performed on data, which have in common [2] pursuit of the same processing purpose. Therefore a distinction has to be made between activities according to shared, specific data processing purposes connected with those activities.

This approach is feasible in practice. The notion of an activity can be so multifaceted that if activities are not grouped according to their purposes, the number of processes identified can be between several hundred and several thousand (some organisations in fact do this). RDPAs of this level of detail cease to be intelligible, useful, and manageable for both the organisation and the supervisory authorities. Records of several thousand activities are questionable from the perspective of the fundamental principle of the GDPR – the principle of accountability.

According to a recommendation published in June 2017 by the Belgian personal data protection authority on keeping RDPAs in connection with Article 30 GDPR, activities recorded in RDPAs or – put another way – data processing procedures have to be identified and grouped according to data processing purposes. Depending on the complexity of data processing procedures, if various data processing activities are performed for the same purpose, then a single entry may (but does not have to) be kept. In the case of large organisations and complex business processes, a number of distinct data processing activities performed for the same purpose can be identified in separate entries, for example in the form of steps in the process in question, to ensure that a record of data processing activities continues to be intelligible.

A larger organisation that manages customer data at several levels and processes them in a number of organisational units can divide those customer relationship management activities into a number of separate activities (entries) even if they are performed for the same purpose.

Examples of data processing activities:

  1. 1)personnel and service provider administration – recruitment and selection of personnel and intermediaries (brokers, independent representatives, etc.); administration of remuneration, extras, commissions and payroll; applying social provisions;
  2. 2)personnel and service provider management – personnel and intermediary evaluation and monitoring; training and career planning;
  3. 3)work organisation – planning and monitoring tasks, work input, and productivity;
  4. 4)monitoring the workplace – monitoring job-related activity in the workplace using video cameras or computer systems (reviewing email, use of telephones and the internet);
  5. 5)client relationships – managing customers, managing orders, deliveries, invoicing tangible and intangible services; monitoring solvency; personalisation of marketing and advertising; registration of the firm’s customers and profiling on the basis of purchasing habits;
  6. 6)combating fraud and breach by customers – preventive measures and detection;
  7. 7)dispute management – including repayment of receivables;
  8. 8)supplier relationships – order management, payments to suppliers; finding and evaluating potential suppliers;

#10.5 Activities Classified in Other Ways

Due to the fact that making distinctions between and registering personal data processing activities according to the purposes they have in common is not an obligation provided for expressly in the GDPR, but only a practical recommendation for organisations required to maintain RDPAs, there is no reason why processing activities cannot be classified in a different way, provided that the record fulfils its function and the principle of accountability is observed.

This means that data can also be divided according to data subject categories (e.g., activities relating to processing of employees’ data), the data scope (e.g., activities relating to basic contact details, and to data concerning employees’ state of health) or the security measures employed (e.g., activities on data locked away in the archives).

#10.6 Record of Data Processing Activities for Small and Large Firms: Differences

The data controller’s challenge is to classify and record data processing activities so that the record is intelligible and fulfil its fundamental functions of (1) enabling the principle of accountability and (2) being informative. The size and complexity of an organisation and the number of business processes it performs in which personal data are processed are also important factors.

As practices to apply the GDPR are developed, smaller businesses need to consider using record-keeping services available on the market, which incorporate the typical, standard data processing activities and specific categories of measures. A business will only be required to specify which options are relevant to their organisation and regularly update the record.

Larger businesses have to take a more individual approach to the record of data processing activities – according to the principle that the larger the organisation, the more categories of particular activities will have to be differentiated due to the volume and diversity of business processes involving personal data processing. Usually, a record in a large organisation has to take account of the division into individual organisational cells within the company so that it corresponds to the steps and elements of the organisation’s business processes.

This is due to the fact that while in a sole proprietorship everything is done by the ‘boss’ and the criterion for division of activities only according to purpose (direct marketing, accounting, suppliers, customers, disputes) is sufficient, in larger companies in which particular organisational units (divisions, departments) are not responsible for the entire process, in the record of data processing activities a distinction will have to be made between recruiting and management of personnel and activities relating to payment of remuneration (even though the purpose of data processing can be listed collectively, as general personnel matters).

#10.6.1 Does Every Organisation Have to Keep a Record of Data Processing Activities? Yes

Formally not every organisation has an obligation under the GDPR to keep RDPAs, but it is recommended that every organisation do so.

Under Article 30(5) GDPR:

The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons, [1] unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, [2] the processing is not occasional, or [3] the processing includes special categories of data as referred to in Article 9(1) [sensitive data], or personal data relating to criminal convictions and offences referred to in Article 10.

As a result, under Article 30(1) in conjunction with Article 30(5) GDPR, a business (organisation) has to maintain a record of data processing activities if:

  • it employs 250 or more people, or
  • it processes data and it is likely to result in a risk to rights and freedoms of data subjects, and this processing is not only occasional, or
  • even if it only occasionally processes data, and this gives rise to a risk to rights and freedoms of data subjects, and this processing relates to special data or data concerning convictions.

#10.6.2 A Headcount of 250

If an organisation employs 250 people, RDPAs have to be drawn up and maintained. The headcount covers both employees and individual contractors.

#10.6.3 High-Risk Processing

Where an organisation has a headcount of less than 250, it needs to conduct a data processing risk assessment to determine whether it performs long-term or regular data processing giving rise to a high risk to the rights and freedoms of individuals or even occasionally processes special data or data relating to convictions, and this gives rise to a high risk to the rights and freedoms of individuals.

In practice, the obligation to keep a record of data processing activities applies in almost every case (who does not process data concerning the health of employees, service providers or their families?). Experts recommend that every organisation keep RDPAs for the following reasons:

  • every organisation has to assess whether it has an obligation to keep RDPAs, and an exemption applies if it is determined that processing does not result in risk to the rights and freedoms of data subjects. This assessment is burdensome in itself and should be documented, and moreover any activity concerning personal data generates risks to their subjects;
  • RDPAs are an aid that shows that small businesses comply with the GDPR. RDPAs enable accountability, ensure mapping of data processing operations and enable identification of measures that need to be taken to comply properly with personal data protection principles;
  • RDPAs are a tool for an organisation to control its own data and information which are business secrets, which is beneficial in the age of the information society and information economy.

#10.7 Scope of Information in RDPAs: Controllers

Article 30(1) GDPR specifies the scope of information that has to be included in the record of data processing activities kept by a controller (or controller’s representative): Each controller, and where applicable, the controller’s representative, shall maintain a record of the data processing activities under its responsibility. That record shall contain all of the following information:

  1. a)the name and contact details of the controller and, where applicable, the joint controller, the controller’s representative and the DPO;
  2. b)the purposes of the processing;
  3. c)a description of the categories of data subjects and the categories of personal data;
  4. d)the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations;
  5. e)where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;
  6. f)where possible, the envisaged time limits for erasure of the different categories of data;
  7. g)where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

As a result, individual, compulsory elements of RDPAs (e.g., columns, if the RDPAs are in a spreadsheet format, or screens, if maintained in the form of an IT tool developed for that purpose or paper files) are as follows:

  1. a)the name and contact details of the controller, for example company X, established in Y, contact details: telephone number: Z; email: W; website: AA;
  2. b)data security officer: John Smith, telephone number: ZZ; email: WW (these details can be put at the top of the document as collective information for all of the other sections of RDPAs);
  3. c)the title of the data processing activity (or business process, as the case may be), for example recruitment, customer service, complaint procedure, human resources management;
  4. d)the purpose of data processing within a particular procedure;
  5. e)categories of data subjects, for example employees, job applicants, customers, suppliers;
  6. f)data categories, for example ordinary data, sensitive data (particular items to be marked or entered manually);
  7. g)categories of recipients, for example divided according to (1) processors, (2) other recipients, i.e. organisations granted access to data in order for them to administer the data, for example a parent company, and (3) third-country recipients (e.g., a processor in India, parent company recipient in the US);
  8. h)information on data processing in a third country and the name of the country and description of data security measures;
  9. i)the data retention period;
  10. j)security measures, for example information about the use of antivirus software, encoding (if that description is possible, this is difficult for complex security systems).

The catalogue of information that may be included in the RDPAs is open. As a tool for ensuring accountability and notification, RDPAs may also contain additional information that the controller (or processor, as the case may be) considers useful as part of their own business activity. The following are examples of non-compulsory elements that can be included in RDPAs:

  1. a)the legal grounds for data processing, for example consent;
  2. b)information about the location of the consent of the data subject, if it is the ground for data processing, for example information that the consent is recorded in system X;
  3. c)information about the manner in which data is collected – whether or not directly from the data subject;
  4. d)brief information about whether the notification obligation is complied with, and in what way, for example by email or normal post;
  5. e)the name of the system used for data processing;
  6. f)the name of the person or department responsible for a particular activity (process).

#10.8 Scope of Information in RDPAs: Processors

Processors are also required to keep records of categories of processing activities carried out on behalf of controllers.

The scope of information that should be contained in a record of data processing categories of a processor is specified in Article 30(2) GDPR, which states:

Each processor, and, where applicable, the processor’s representative shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing:

  1. a)the name and contact details of the processor or processors and each controller, and, where applicable, of the controller’s or the processor’s representative, and the data protection officer;
  2. b)the categories of processing carried out on behalf of each controller;
  3. c)where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation, and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;
  4. d)where possible, a general description of the technical and organisational security measures referred to in Art. 32(1).

The scope of compulsory information in the record of data processing activities of the processor is therefore somewhat reduced in relation to RDPAs of controllers. Like controllers, processors are required to record their full name and contact details, details of the data security officer, information about data processing in a third country, and, where possible give a general description of the security measures.

In the RDPAs, processors have to specify the categories of processing performed on behalf of each controller. The GDPR does not state precisely the categories of processing. Because the range of detail in processors’ RDPAs is less than controllers’ RDPAs, and there is no obligation to specify particular data processing activities performed on data entrusted by particular controllers, ‘processing categories’ is a broader and more general notion. This is a question of business functions, for example keeping accounts, calculating remuneration and costs (payroll), data storage, building security, including video surveillance.

#10.9 Form of RDPAs

Under Article 30(3) GDPR:

The records referred to in paragraphs 1 and 2 shall be in, including in electronic form.

There is a general consensus that there is no obligation to maintain RDPAs in paper form, because this would be of no use from a practical point of view. RDPAs may therefore be kept in electronic form, for example in a spreadsheet or in a special software developed for that purpose.

#10.10 Person Responsible for Keeping RDPAs

Keeping a data processing activities record is a general obligation of the controller and processor. In practice, a person has to be designated to be responsible for keeping, updating, and where necessary allowing the supervisory authority access to a record of data processing activities. This person may be a personal data protection expert or data security officer. The obligation to keep the record of data processing activities is not among the data security officer obligations listed in Article 39(1) GDPR, but this task does not affect the independence of the data security officer and does not cause a conflict of interest with the data security officer’s other obligations. On the contrary, the keeping of a record of data processing activities by a data security officer is closely aligned with the data security officer’s other tasks and function.