Processing register (GDPR Article 30) with example

A processing register is an overview of all processing of personal data in your organisation: which data, from whom, for what purpose, for how long and with whom you share it. The obligation is set out in Article 30 of the GDPR , where it is called the “record of processing activities”. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) lists the register as one of the mandatory measures under the accountability principle.

For ISO 27701, the register is the foundation of your PIMS. Without a register, you cannot properly handle a risk analysis, a DPIA or a data subject request. On this page you will find what it must contain, an example you can adapt, and the mistakes that auditors see most often.

Are you required to keep a processing register?

Almost always. Organisations with more than 250 employees must always keep one. Smaller organisations must as well, as soon as one of these three situations applies (Article 30(5)):

Situation	Does this apply to you?
The processing is not occasional	Almost always: payroll administration and customer data are structural
The processing poses a risk to data subjects	For example camera surveillance or location data
You process special categories of personal data	Health, sickness absence, religion, biometrics

The AP itself says that processing is rarely occasional in practice. A company with five employees and a customer file therefore also needs a register. In practice, the exemption for small organisations is very narrow.

What must a processing register contain?

The GDPR specifies the information required for each role. If you are a controller, you record the following for each processing activity.

Mandatory field (Art. 30(1))	Explanation
Name and contact details	Of your organisation, any joint controllers, and your data protection officer (FG, functionaris gegevensbescherming)
Purposes	Why you process the data
Categories of data subjects	For example customers, employees, job applicants
Categories of personal data	For example name and address, citizen service number (BSN), sickness absence data
Categories of recipients	To whom you disclose the data, including processors
Transfers outside the EEA	To which country, and on what basis
Retention periods	When you erase the data, if known
Security measures	A general description

The AP recommends also recording the legal basis for each processing activity. That is not mandatory, but without a legal basis in the register, it is harder to demonstrate your accountability. ISO 27701 effectively does require it.

Example processing register (controller)

Fictional example. Van Dijk installation company has 40 employees and works for private individuals and housing associations. These are four lines from the register. Copy the columns and fill them in for your own processing activities.

Processing activity	Purpose	Legal basis	Data subjects	Data	Recipients	Retention period	Security
Payroll administration	Paying wages, payroll tax returns	Legal obligation, contract	Employees	Name and address, BSN, IBAN, wages	Payroll provider, Dutch Tax Authority (Belastingdienst)	7 years after the end of the year (tax)	Access for HR and management only
Sickness absence records	Reintegration and continued wage payment	Legal obligation	Employees	Dates of sickness and recovery, no diagnosis	Occupational health service (Arbodienst)	2 years after the end of the absence	Separate file, HR only
Work orders and planning	Carrying out jobs	Contract	Customers, tenants	Name, address, phone, photos of the installation	Planning software (processor)	7 years (invoice data)	Personal accounts, two-step verification
Vehicle tracking system	Trip logging and planning	Legitimate interests	Fitters	Location, trips	Supplier track-and-trace	1 year	No access during private time

Note the last row. Employee location data is on the Dutch Data Protection Authority’s list of processing for which a DPIA is mandatory. The register thus points you to processing that needs extra attention.

The retention periods in this example are indications. Check for each processing activity which statutory period applies, for example the tax retention obligation. Where no statutory period exists, choose a period yourself and justify it.

Processing register for a processor

If you work on behalf of clients, such as a software supplier or an administration firm, you keep a separate register (Article 30(2)). It is shorter.

Mandatory field	Example for a SaaS supplier
Name and contact details of you, each client, and your data protection officer	Client: Municipality X, contact: privacy team
Categories of processing per client	Hosting and management of the case management system, back-ups, support
Transfers outside the EEA	None; support tool in the EU
Security measures	Encryption, logging, annual penetration test

Many companies are both: a processor for customer data and a controller for their own staff. Then you have two registers, or one register with a clearly labelled “role” column.

How do you set up a processing register?

Do not start with an empty Excel file, but with conversations. For each department, check which systems and lists containing personal data exist. HR, sales, customer service and IT produce most of the processing activities.

Then record the fields from the table for each processing activity. Link each processing activity to the systems in your asset register and to the data processing agreement with the supplier. That way you can see immediately where an agreement is missing.

Assign an owner to each processing activity. That owner reports changes, such as a new supplier or a new purpose. Plan at least one check per year.

Processing register and ISO 27701

ISO 27701 turns the register into a living document. The standard requires you to know which personal data you process, for what purpose and on what legal basis. During the ISO 27701 audit, the register is one of the first documents the auditor requests.

What the auditor checks	How you demonstrate it
Completeness	The register matches your systems, suppliers and processes
Currency	Date of change and owner for each line
Legal basis per purpose	Completed and justified
Link with risks	High-risk processing has a DPIA
Retention periods are observed	Deletion log or sample

A register that was drawn up once and never updated is the most common finding. Software can help; for that, read choosing PIMS software.

Common mistakes in the processing register

Systems instead of processing activities. “Microsoft 365” is not a processing activity. “Customer correspondence” is.
No retention period. “As long as necessary” is not enough. Name a period or a trigger point.
Special categories of data not listed separately. Sickness absence, health and BSN should be explicitly recorded in the register.
The register is disconnected from practice. New tools are added without anyone updating the register.

Frequently asked questions about the processing register

May a processing register be kept in Excel?

Yes. The AP says you may decide how to set up the register, as long as the mandatory fields are included. A spreadsheet is perfectly adequate for a small business. With many processing activities or several roles, software is clearer.

Must you make the processing register public?

No. However, you must be able to show the register to the Dutch Data Protection Authority on request (Article 30(4)). You inform data subjects through your privacy statement, not through the register.

How often should you update the processing register?

With every change: a new tool, a new purpose or a new supplier. In addition, plan a full check at least once a year with the owners of the processing activities.