---
title: "Keep the record of processing as data · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/records-and-data-map/records-of-processing
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep the record of processing as data

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map)
- Rule: Keep the record of processing that GDPR Article 30 asks for as data in the repository. Build it on the data map and render it on demand.
- How: Write one entry per purpose, such as billing or support. Article 30(1) lists the fields a controller needs. They are the purposes, the kinds of people and data, and the recipients. Add transfers outside the EU with safeguards, retention periods and a security summary. Add the legal basis from Article 6 to each entry, since the privacy policy needs it too. If you are a processor for customers, keep the shorter Article 30(2) record per customer as well. Refer to stores by their data map IDs. Render the record as a document, because the authority may ask for it. The Article 30(5) exemption for firms under 250 staff falls away when processing is regular, so most apps need the record. A 2025 Commission proposal would move that limit from 250 to 750 staff. It was still a proposal in October 2026, so do not rely on it yet.
- Check: A script fails when an entry lacks an Article 30 field or a legal basis, or names a store missing from the data map. It also fails when a mapped store has no entry.

Example:

```yaml
- id: support
  purpose: Answer customer questions and complaints
  legal_basis: contract (Article 6(1)(b))
  subjects: [customers, prospects]
  data: [name, email, message text, order number]
  stores: [orders-db, support-desk]
  recipients: [support-desk]
  transfers: [{ to: US, store: support-desk, safeguard: EU-US Data Privacy Framework }]
  retention: support-tickets
  security: [encryption at rest, single sign-on with two factors, audit log]
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/records-and-data-map/records-of-processing`.

- Previous: [Map every store that holds personal data](https://agentwranglers.se/playbook/compliance/records-and-data-map/data-map)
- Next: [Mark special categories and children's data](https://agentwranglers.se/playbook/compliance/records-and-data-map/special-category-flags)
- [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map)