Keep the record of processing as data

How to do it

Write one entry per purpose, such as billing or support. Article 30(1) lists the fields a controller needs. They are the purposes, the kinds of people and data, and the recipients. Add transfers outside the EU with safeguards, retention periods and a security summary. Add the legal basis from Article 6 to each entry, since the privacy policy needs it too. If you are a processor for customers, keep the shorter Article 30(2) record per customer as well. Refer to stores by their data map IDs. Render the record as a document, because the authority may ask for it. The Article 30(5) exemption for firms under 250 staff falls away when processing is regular, so most apps need the record. A 2025 Commission proposal would move that limit from 250 to 750 staff. It was still a proposal in October 2026, so do not rely on it yet.

Example

- id: support
  purpose: Answer customer questions and complaints
  legal_basis: contract (Article 6(1)(b))
  subjects: [customers, prospects]
  data: [name, email, message text, order number]
  stores: [orders-db, support-desk]
  recipients: [support-desk]
  transfers: [{ to: US, store: support-desk, safeguard: EU-US Data Privacy Framework }]
  retention: support-tickets
  security: [encryption at rest, single sign-on with two factors, audit log]

How to check

A script fails when an entry lacks an Article 30 field or a legal basis, or names a store missing from the data map. It also fails when a mapped store has no entry.