do I as a self-employed person also need to keep a processing record

Usually yes, even without employees

A sole proprietorship or self-employed person falls under the GDPR as soon as personal data are processed, and that is the case in almost every business — a customer database, a mailing list, invoices with names and addresses on them, that already counts. The GDPR makes no exception for small businesses or sole proprietorships as such; the obligation to maintain a register does not depend on the legal form, but on what is processed and how often.

In practice, the exception to the register only applies to organisations with fewer than 250 employees, and even then only if the processing is occasional, poses no risk to the individuals whose data it is, and does not concern special data such as health or criminal record information. A self-employed person who systematically records customer data, sends a newsletter or uses an accounting package, as a rule does not process occasionally — this removes the exception and leaves the main rule: maintain a register. What exactly must be in it is described on the page about what must be in a processing register.

Where that rests on: Article 2 and Article 30 of the GDPR

Article 2 of the GDPR determines the material scope: the regulation applies to the processing of personal data, regardless of the size or form of the organisation that processes. Article 30 of the GDPR imposes the obligation to maintain a register on both the controller and the processor, and contains in the same article the exception for small organisations with occasional, low-risk processing. These two articles work together: one determines whether the GDPR applies, the other whether the register obligation actually applies within it. For those uncertain whether their own role is that of processor or controller — relevant because that also partly determines what must be recorded — the page about processor or controller offers more guidance. Supervision of compliance with Article 30 lies with the supervisory authority of the Member State where the business is established — in the Netherlands that is the Dutch Data Protection Authority; in other EU countries it is the supervisory authority of that country. The obligation itself, and the exception to it, are indeed in the regulation and thus apply in the same way throughout the EU.