GDPR Article 30: Records of processing activities

What this article means in practice

Written by Engage Compliance. The text above is the article itself, reproduced from its official source and unchanged. Everything in this section is ours, and last read against the current text on 2026-09-07.

Article 30 is the record of processing activities, and it is the document that makes a representative appointment operational rather than nominal. The representative maintains a record under Article 30(1) as its own obligation, and Article 30(4) is what a supervisory authority uses: it can ask the representative for the record directly.

Who it binds

• Every controller, and where applicable the controller's representative, for processing under its responsibility (Article 30(1)).
• Every processor, and where applicable the processor's representative, for categories of processing carried out on behalf of a controller (Article 30(2)).
• It does not bind an enterprise or organization employing fewer than 250 people (Article 30(5)), UNLESS the processing is likely to result in a risk to rights and freedoms, or is not occasional, or includes Article 9(1) special category data or Article 10 criminal conviction data.
• The Article 30(5) exemption is far narrower than the headcount makes it sound. Regular processing of customer data is not occasional, so most small companies with an ongoing product are back in scope through the second limb.

What it makes somebody do

• You, the controller. Record the seven items in Article 30(1): your details and those of any joint controller, representative and data protection officer; the purposes; the categories of data subjects and of personal data; the categories of recipients including those in third countries; transfers with their safeguards; erasure time limits where possible; and a general description of the Article 32(1) security measures where possible.
• You, the processor. Record the four items in Article 30(2), which is a shorter list built around whose behalf you act on and what categories of processing you carry out.
• Everyone. Keep it in writing, including electronic form (Article 30(3)). There is no prescribed format beyond that.
• You or your representative. Make the record available to the supervisory authority on request (Article 30(4)).
• The representative. Maintain the record under Article 30(1) as its own obligation. The Article names the representative alongside the controller, so this is not a copy held as a courtesy.

What it does not say

• It is not a privacy notice. The record is an internal document produced to a supervisory authority on request; Articles 13 and 14 govern what you tell people.
• It does not require a specific tool or template. Article 30(3) requires writing and nothing further, so a spreadsheet that contains the seven items satisfies it and a costly platform that does not, does not.
• The 250-employee line in Article 30(5) is not an exemption most companies get. Three separate limbs each pull you back in, and being not occasional is the one that catches almost everyone with a live product.
• Article 30(1)(f) and (g) are qualified by where possible. The erasure limits and the security description are the two items the Regulation itself accepts you may not always be able to give.
• It does not make the representative responsible for the CONTENT being accurate. The representative maintains a record of your processing, which it can only do from what you give it and keep current.

How it sits beside the other mandates

• Article 27 and Article 30 are the pair that make a representative appointment real. Article 27 creates the appointment; Article 30 is what the appointed party holds and produces.
• Under the Swiss FADP the equivalent record sits differently: Article 15(1) makes maintaining it the representative's own duty in a way that goes further than Article 30 does, so a company holding both appointments runs two records under two different arrangements.
• Article 32(1) is what Article 30(1)(g) points at, so the security description in the record is a summary of an obligation that lives elsewhere rather than a free-standing requirement.