Record of processing activities: what must it contain and do you need one?

Published 3 November 2026

Summary: A record of processing activities under Article 30 of the GDPR is a written list of your processing of personal data, including the purposes, categories of data subjects and personal data, recipients, transfers to third countries and, where possible, erasure time limits and security measures. The exemption for organisations with fewer than 250 employees does not apply if the processing is not occasional, is likely to result in a risk or includes sensitive data or data on criminal offences. IMY (the Swedish Authority for Privacy Protection) gives payroll as an example of processing that must be recorded. In practice almost every employer therefore needs a record, and IMY recommends one regardless of the exemption.

What the record must contain under Article 30(1)

Under Article 30(1) each controller “shall maintain a record of processing activities under its responsibility”. The record must contain all of the following:

• The name and contact details of the controller and, where applicable, the joint controller, the representative and the data protection officer (a).
• The purposes of the processing (b).
• A description of the categories of data subjects and of the categories of personal data (c).
• The categories of recipients to whom the data have been or will be disclosed, including recipients in third countries (d).
• Where applicable, transfers to a third country or an international organisation and, for transfers under the second subparagraph of Article 49(1), the documentation of suitable safeguards (e).
• Where possible, the envisaged time limits for erasure of the different categories of data (f).
• Where possible, a general description of the technical and organisational security measures under Article 32(1) (g).

The record must be in writing, including in electronic form (Article 30(3)), and made available on request to IMY under Article 30(4). The regulation prescribes no template or particular tool, so a spreadsheet can be enough. IMY publishes a checklist that follows the points of the article and says that the record must be kept up to date.

Erasure time limits and security measures are required “where possible”, but that is rarely impossible, and without erasure time limits it is hard to show that you follow the storage limitation principle in Article 5(1)(e). Article 30 does not require the legal basis, but you will need it whenever a data subject, a customer or IMY asks, so we always include it.

If you are a processor

If you process personal data on behalf of someone else, for example as an IT provider or payroll bureau, Article 30(2) also requires a record of the categories of processing you carry out for each controller. It contains the name and contact details of you, of each controller and of representatives and data protection officers, the categories of processing, any transfers to third countries and, where possible, a general description of the security measures.

Many organisations are both. A municipal company is the controller for its staff and customers but may also carry out processing for the municipality that owns it. Keep the two records apart, because they describe different responsibilities.

The 250-employee myth

A common misunderstanding is that the record only applies to organisations with at least 250 employees. Article 30(5) says that the obligation does not apply to those employing fewer than 250 persons unless:

• the processing is likely to result in a risk to the rights and freedoms of data subjects,
• the processing is not occasional, or
• the processing includes special categories of data under Article 9(1) or data relating to criminal convictions and offences under Article 10.

So one condition is enough. IMY takes the view that each processing activity must be assessed on its own and gives payroll as an example: it is not occasional and must be recorded, even if another activity in the same organisation need not be. Regardless of the exemption, IMY recommends keeping a record to keep track internally.

In our assessment customer registers, email and case handling, access control and camera surveillance are also rarely occasional. What may fall outside is precisely the occasional, for example a one-off list of participants deleted after an event.

How to map your processing in workshops

A record filled in by one person alone often becomes a list of systems rather than of processing activities. Short workshops with the people who work with the data give a better result. This is how we usually set it up:

1. Start from the business, not from IT. Split by function: HR, finance, sales and marketing, IT and the processes specific to your business.
2. Hold one workshop per function, often 60–90 minutes, with the process owner and someone who does the daily work.
3. Ask the same questions every time: which people, which data, why, where is it stored, who receives it and when is it deleted?
4. Check against the list of systems and the supplier ledger. Licences and invoices often reveal processing nobody mentioned.
5. Enter the answers straight into the record and put what is uncertain, for example an unclear legal basis or a missing data processing agreement, on an action list.

A processing activity is a purpose, not a system. Payroll may use three systems, and one system may carry several processing activities.

A sample row: payroll

Your contact details and those of the data protection officer, point (a), can appear once at the top of the record instead of in every row.

Field	Example
Purposes (b)	Pay salaries, deduct tax, report employer contributions and handle pensions and absence
Data subjects (c)	Employees and former employees
Personal data (c)	Name, personal identity number, bank account, salary, tax details and absence. Sick leave is data concerning health under Article 9(1) and should be flagged.
Recipients (d)	The Swedish Tax Agency, the bank, pension providers and a payroll bureau as processor
Third countries (e)	None, if the supplier and its sub-processors process the data within the EU/EEA and no separate recipient in a third country gets access to it. Check both the storage location and support and remote access in the data processing agreement.
Erasure (f)	Accounting information is kept until the end of the seventh year after the end of the calendar year in which the financial year ended (Swedish Bookkeeping Act, Chapter 7, Section 2 (7 kap. 2 §)). Other data according to the retention plan.
Security (g)	Access limited to payroll and HR, multi-factor sign-in and access logging
Legal basis (addition)	Contract and legal obligation, Article 6(1)(b) and (c), depending on the processing. Sick leave and other data concerning health also need an exception under Article 9(2), normally Article 9(2)(b) for obligations in employment law (Swedish Data Protection Act, Chapter 3, Section 2 (3 kap. 2 §)).
Systems, owner and review (addition)	Payroll system and HR system; the HR manager; last reviewed with a date

The fields marked “addition” are not required by Article 30, but they make the record useful when you answer a subject access request, assess a breach or review a supplier.

Keep the record alive

A record that was accurate three years ago says little about today. Tie updates to events rather than to someone’s memory:

• New system or supplier: procurement or IT updates the row before the contract is signed.
• New purpose: check it against the original purpose and update the row.
• Impact assessment or personal data breach: check that the row matches the conclusions.
• At least once per year: each process owner confirms their rows with a date.

Give every row an owner in the business. In our division of the GDPR into 15 parts, the record is part 8, and it ties directly to mapping (part 6), retention (part 9) and suppliers (part 12). If a processing activity has an impact assessment, it should follow along when the row changes; see when an impact assessment needs updating.

What you have when the record is done

• A list with the information Article 30(1) requires and, where relevant, a processor record under Article 30(2).
• The legal basis, systems and owner for each processing activity.
• Erasure time limits that can be carried over into a retention plan.
• An action list, for example missing data processing agreements or unclear transfers.
• A basis for the information to data subjects and something concrete to show IMY, customers and procurers.

If you first want to see where you stand overall, start with our GDPR self-test.

Would you like help producing the record? In GDPR Start we map your processing in workshops with HR, finance, sales and IT, among others, and produce the record with the purpose, legal basis and retention period for each processing activity, together with a retention plan and privacy information. Read more about our work with data protection and privacy or contact us.

Sources: Regulation (EU) 2016/679 (GDPR), Articles 5, 6, 9, 10, 13, 14, 30, 32 and 49; Swedish Authority for Privacy Protection (IMY), Maintain a processing record (Föra register över behandling) and Sensitive personal data (Känsliga personuppgifter); Swedish Bookkeeping Act (bokföringslagen, 1999:1078), Chapter 7, Section 2 (7 kap. 2 §); Swedish Data Protection Act (dataskyddslagen, 2018:218), Chapter 3, Section 2 (3 kap. 2 §). Verified 2026-10-03.

This text is general information and not legal advice. How the rules apply to you depends on your processing and needs to be assessed in the individual case.