What must a processing register contain?

What is recorded in the processing register

A processing register describes, for each processing of personal data that an organisation carries out, who is responsible for what and what happens to the data. Specifically, this includes the name and contact details of the organisation (and of the data protection officer, if one exists), the purposes for which data are processed, the categories of data subjects and the categories of personal data involved, the categories of recipients to whom data are disclosed, whether data are transferred outside the EU and if so under what safeguards, the retention periods that are applied or the criteria by which those are determined, and a general description of the technical and organisational security measures.

An organisation that itself acts as a processor — that is, processes personal data on behalf of another party — maintains a comparable but slightly more limited register, focused on the categories of processing carried out for each controller. For smaller organisations, Article 30 of the GDPR provides an exemption: those with fewer than two hundred and fifty employees do not have to maintain this register, unless the processing presents a risk to the rights and freedoms of data subjects, is not occasional, or concerns special categories of data or data relating to criminal convictions. In practice, this exemption applies to fewer SMEs than it might seem to promise, because regular processing of customer or employee data is quickly regarded as not being occasional.

Where this comes from: Article 30 GDPR

These elements are listed in Article 30, first and second paragraphs, of the GDPR, with the exemption for smaller organisations in the fifth paragraph of that same article; the Dutch Data Protection Authority explains on its website how it approaches this in Dutch practice.