How to Keep a Data Processing Record: A Practical Guide
Many data protection laws around the world require organisations to keep a written record of how they handle personal data, what data they hold, why they hold it, where it goes, and how long they keep it. This record, often called a record of processing activities, is the backbone of accountability: it’s usually the first document a regulator asks for, and it’s the map your own team uses to answer questions like “where do we keep customer emails?” or “who can see employee records?”
This guide explains how to use the Data Processing Record Sheet, what each section captures and the mistakes that make records useless. It is general information, not legal advice. Data protection law varies significantly by jurisdiction, including which organisations must keep records and what they must contain. Check your local requirements or get advice before treating this as complete.
When to Use This
Use the record sheet if your organisation collects or uses personal data in any systematic way, and almost every business does. Customer lists, employee records, supplier contacts, marketing databases, website analytics, CCTV footage, job applications: each is a processing activity that belongs in the record.
Start the record before you need it, not during an incident. Building it calmly, activity by activity, produces an accurate map. Building it the week a regulator comes knocking, or after a data breach, produces a rushed document nobody trusts.
Review and update it whenever you adopt a new tool, start a new activity, or change how data flows. A new email marketing platform, a new HR system, or a move to cloud storage all change the picture.
How to Fill It Out
Section 1: Processing activity. Give each activity a clear name: “payroll processing”, “email marketing to customers”, “recruitment”, “website analytics”, “CCTV at reception”. One row per activity, not one row for “all our data”. Vague entries defeat the purpose, the record should let someone unfamiliar with your business understand what you do with personal data.
Section 2: Data categories and individuals. For each activity, note what personal data is involved (names, email addresses, financial details, health information, images) and whose data it is (customers, employees, suppliers, website visitors, job applicants). Be specific about sensitive categories, many jurisdictions impose stricter rules on health data, biometric data, or children’s data, so flagging them here matters.
Section 3: Purpose and legal basis. State why you process the data and the lawful basis under your local law. Basis names differ by jurisdiction, but common concepts include consent, contract performance, legal obligation, and legitimate interests. Don’t copy legal bases from another company’s record or another country’s guidance, the basis must be valid where you operate, for that specific purpose. If you’re unsure, that’s a question for legal advice, not guesswork.
Section 4: Recipients and transfers. List who receives the data: processors and service providers (your cloud email provider, payroll bureau, analytics tool, payment processor), group companies, and any public authorities. Note transfers to other countries, since cross-border transfers often carry extra requirements. This section surprises people, most organisations share data with far more third parties than they realise, and mapping them is half the value of the exercise.
Section 5: Retention and security. How long each data category is kept, and what triggers deletion, link this to your document retention schedule rather than inventing periods here. Summarise the security measures protecting the data (access controls, encryption, staff training). You don’t need technical detail; you need evidence that security was considered per activity.
Section 6: Owner and review date. Name the person responsible for each activity, the department head or system owner who can answer questions about it, and record when the entry was last reviewed. An entry with no owner is an entry nobody maintains.
Common Mistakes
1. One vague entry instead of per-activity records. “We process customer and employee data” tells a regulator nothing. Break processing into real activities. Ten precise rows beat one sweeping paragraph every time.
2. Copying legal bases from another jurisdiction. Lawful bases are creatures of local law. A basis that’s valid under one country’s framework may not exist in yours. Get the legal basis right for your jurisdiction or get advice, this is the section regulators scrutinise.
3. Forgetting processors and tools. Your email provider, your cloud storage, your survey tool, your website analytics, every service that touches personal data on your behalf belongs in the record. Shadow IT is the usual culprit: the marketing tool someone signed up for without telling anyone.
4. Writing it once and never updating it. A record that doesn’t reflect reality is worse than no record, because it creates false confidence. Tie updates to change: new system, new activity, new supplier, update the record as part of the change, not months later.
Who Needs to Sign Off
Each activity owner provides the facts for their entries, they know what data their team actually handles. A data protection lead, privacy officer, or designated responsible person reviews the full record for completeness and consistency. Senior management should approve it formally; accountability for data protection sits at the top, and the sign-off makes that real. If you use external processors for significant activities, confirm the details with them rather than assuming.
How Often to Review and Update
Review each entry at least annually, and update immediately when an activity changes, new tools, new data types, new recipients, new countries. Run a full-record review once a year: walk through every activity with its owner and confirm it’s still accurate. Also review the record after any data breach or complaint; incidents reveal gaps in the map.
Download the free Data Processing Record Sheet.
Disclaimer: this guide is general information, not legal advice. Data protection laws, record-keeping duties, and lawful bases vary by jurisdiction. Always check your local requirements and consider professional advice for your specific situation.