For a small business with a manageable number of processing activities — payroll administration, accounting, a customer database, a few SaaS tools — the first rough overview can often be created in a few hours. The lead time to a register that is truly complete and usable is higher in practice: expect a few days of work, spread over two to four weeks. That spread is not because the data entry itself takes long, but because in between you are waiting for answers from others.
The law itself does not set a deadline for drawing up a register. What the GDPR does require is that a controller maintains an overview of the processing activities for which it is responsible, including in particular the purpose, categories of data and recipients, and retention periods. How long it takes to get there therefore does not depend on a legal deadline but on how well your organisation itself knows what happens with data.
Where the first days go
The first phase is about inventorying: which systems do you use, who has access, and what data is in them. For a sole trader or a business with a handful of employees, this is often manageable in one morning. At an organisation with multiple departments, this quickly becomes more complex, simply because no one person has the complete picture: HR knows which tools they use for recruitment and absence management, administration knows which accounting package is running, and management often does not know that the marketing department has taken out a separate CRM subscription. This fragmentation is the first and greatest source of delay, not the data entry work itself.
A practical approach is to start with invoices: every subscription that is debited monthly is a good indication of a processing activity that belongs in the register. A library of well-known SaaS tools can speed up this part, because common software is already provided with the usual purposes and retention periods, so you do not have to work them out yourself. In the knowledge base you will find a short answer per topic with the source in the official text, which is helpful in determining what belongs in the register and what does not.
Where it gets stuck: processor agreements
The second delay occurs when linking processor agreements to the processing activities in the register. For each SaaS vendor that processes personal data on your behalf, there should be an agreement in place. In practice, it often turns out that it does not exist, or no one is certain of the latest version anymore. This means you have to contact vendors, which can result in days or weeks of waiting time — not because drawing up the agreement takes long, but because you depend on how quickly another company responds.
It is therefore smarter not to treat the register and monitoring of processor agreements as two separate projects, but as one ongoing process: as soon as a new tool is purchased, the agreement should come with it straight away, rather than having to reconstruct afterwards what was ever agreed.
Lead time when growing and changing
A register is never finished in the sense that it never changes after that. New tools, new staff, new customer processes — each one affects the register again. The time required for a one-off inventory therefore says little about the maintenance that follows. Companies that fill in the register only at start-up and then leave it alone run the risk that after a year it no longer matches reality. Those who let the register grow along with the tool library and automatically alert themselves when something is missing save themselves the repeated inventory work that would otherwise be needed at every audit or tender.
For those who need to demonstrate that the foundations are in order — for example to an insurer or in a procurement process — it matters not only that a register exists, but also how up-to-date it is. An overview from six months ago, when three new tools have since been added, paints a different picture than a register that is updated weekly.
Do it yourself or let it run alongside
Whether you maintain the register yourself in a spreadsheet or have it filled from a system, the time required is in both cases mainly in gathering information, not in entering it. The difference lies in the maintenance: a spreadsheet requires you to remember yourself when something needs to be updated, while a system that is linked to your tool library and your data processing agreements signals that for you. More on how that linkage works exactly can be read on the page about how the system works.
If you want to know what a complete, up-to-date register would cost your situation in terms of time and resources, the pricing overview gives an indication of what suits your company size. And should you be in doubt whether your current overview is sufficient, you will find the frequently asked questions answers to a number of practical dilemmas.
The ultimate assessment of whether your register meets the legal requirements is up to you or a lawyer, and in case of doubt the Dutch Data Protection Authority. If you first want to get a picture of where you stand, take the free quick-scan or browse through the topics in the knowledge base.