--- title: 'The Record of Processing Activities: what it is for and who must keep it' url: 'https://argobs.com/en/il-registro-dei-trattamenti-a-cosa-serve-e-chi-deve-adottarlo' markdown: 'https://argobs.com/en/il-registro-dei-trattamenti-a-cosa-serve-e-chi-deve-adottarlo.md' lang: en date: '2021-04-09' description: 'Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, more commonly known as the “GDPR”, requires a record of processing activities to be kept: a document that must be drawn up and maintained by both the c…' taxonomy: category: - gdpr --- # The Record of Processing Activities: what it is for and who must keep it 9 April 2021 | GDPR [Regulation (EU) 2016/679](https://eur-lex.europa.eu/legal-content/IT/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ITA&toc=OJ%3AL%3A2016%3A119%3ATOC) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, more commonly known as the “GDPR”, requires a **record of processing activities** to be kept: a document that must be drawn up and maintained by both the controller and the processor of personal data, pursuant to [Article 30](https://eur-lex.europa.eu/legal-content/IT/TXT/HTML/?uri=CELEX%3A32016R0679&from=IT#d1e3272-1-1) of the Regulation. Specifically, the **controller** is the party that determines the purposes and means of the processing. The **processor** is the party that processes personal data on behalf of the **controller**. Controllers and processors **are required to draw up and keep their records up to date**. **In theory, enterprises and organizations with fewer than 250 employees would be exempt from the obligation**. However, **companies and organizations with fewer than 250 employees must also draw up and keep their records up to date** where: - the processing they carry out is likely to result in a risk to the rights and freedoms of data subjects; - the processing is not occasional; - the processing includes special categories of data, such as racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or a natural person's sex life or sexual orientation, ([Article 9](https://eur-lex.europa.eu/legal-content/IT/TXT/HTML/?uri=CELEX%3A32016R0679&from=IT#d1e2058-1-1)) or personal data relating to criminal convictions and offences, ([Article 10](https://eur-lex.europa.eu/legal-content/IT/TXT/HTML/?uri=CELEX%3A32016R0679&from=IT#d1e2145-1-1)). Therefore, **even very small B2B companies** - which process only customers' contact details and employee data in managing the employment relationship - **must keep a record of processing activities**. But what information must the records contain? **THE CONTROLLER'S RECORD** Maintaining the record is the responsibility of the controller and, where applicable, the controller's representative, and it must necessarily contain: 1. the **name** and **contact details** of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer; 2. the **purposes of the processing**; 3. a description of the **categories of data subjects** and of the **categories of personal data**; 4. the **categories of recipients** to whom the personal data have been or will be disclosed, including recipients in third countries or international organizations; 5. where applicable, **transfers of personal data to a third country or an international organization**, including the identification of that third country or international organization and, in the case of transfers referred to in the second subparagraph of [Article 49](https://eur-lex.europa.eu/legal-content/IT/TXT/HTML/?uri=CELEX%3A32016R0679&from=IT#d1e4544-1-1) of the Regulation, the documentation of suitable safeguards. 6. where possible, the **envisaged time limits for erasure of the different categories of data**; 7. where possible, a general description of the technical and organizational **security measures** referred to in [Article 32](https://eur-lex.europa.eu/legal-content/IT/TXT/HTML/?uri=CELEX%3A32016R0679&from=IT#d1e3390-1-1), paragraph 1 of the Regulation. **THE PROCESSOR'S RECORD** The processor and, where applicable, the processor's representative are required to maintain a record of all categories of processing activities carried out on behalf of a controller, containing: 1. the **name** and **contact details** of the processor or processors, of each controller on behalf of which the processor is acting, of the controller's or processor's representative and, where applicable, of the data protection officer; 2. the **categories of processing carried out** on behalf of each controller; 3. where applicable, **transfers of personal data to a third country** or an international organization, including the identification of that third country or international organization and, in the case of transfers referred to in the second subparagraph of [Article 49](https://eur-lex.europa.eu/legal-content/IT/TXT/HTML/?uri=CELEX%3A32016R0679&from=IT#d1e4544-1-1) of the Regulation, the documentation of suitable safeguards; 4. where possible, a general description of the technical and organizational **security measures** referred to in [Article 32](https://eur-lex.europa.eu/legal-content/IT/TXT/HTML/?uri=CELEX%3A32016R0679&from=IT#d1e3390-1-1), paragraph 1 of the Regulation. Both records **must be kept in writing, including in electronic form, and constantly updated, showing not only the date of creation but also the date of the last update**, so that they can be made available on request to the supervisory authority, namely the Italian Data Protection Authority (the Garante). To help SMEs, the Garante has provided simplified versions of the [controller's](https://www.garanteprivacy.it/documents/10160/0/Modello+di+%E2%80%9Cregistro+semplificato%E2%80%9D+delle+attivit%C3%A0+di+trattamento+del+titolare+per+PMI.pdf/ca77f44e-0f85-4b01-6135-f3a7fc5182ec?version=1.2) and [processor's](https://www.garanteprivacy.it/documents/10160/0/Modello+di+%E2%80%9Cregistro+semplificato%E2%80%9D+delle+attivit%C3%A0+di+trattamento+del+responsabile+per+PMI.pdf/5a4dfd05-6c79-ff2f-f48f-14e5a3a87817?version=1.1) record. **CONTACT ARGO** Need support drafting your records? Have you already adopted them but want to outsource their periodic updating? Write to and tell us about your needs. --- ## Navigation - Parent: [News](https://argobs.com/en/news.md) - Previous: [How to remove counterfeit products from Amazon](https://argobs.com/en/come-eliminare-i-prodotti-contraffatti-da-amazon.md) - Next: [GDPR: which organizations must appoint a DPO?](https://argobs.com/en/gdpr-quali-organizzazioni-devono-nominare-un-dpo.md)