You can in principle keep your record of processing activities entirely yourself. The GDPR does not prescribe a specific program or format: a well-maintained document or spreadsheet will do, as long as it is complete, accurate and up to date. What matters is not the tool, but the content: what personal data you process, for what purpose, who has access to it, how long you keep it and which other parties see it.
The practical question is therefore not whether it is permitted, but whether it remains manageable in your business. With a handful of fixed processing activities — an accounting package, payroll administration, a CRM — a self-made overview is often easy to maintain. As soon as the number of tools grows, processors change or staff members purchase software themselves, maintenance becomes a recurring task that is easily postponed.
What must be in there anyway
A record describes per processing activity the purpose, the categories of data and data subjects, the retention period or an indication of it, and the parties with whom data are shared. For processing activities carried out through an external party, it should also be clear whether a processor agreement is in place. The precise requirements and the exceptions to them are set out in the GDPR itself and are elaborated in guidelines from the Dutch Data Protection Authority and the EDPB. If you want to have this worked out per situation, you will find it in the knowledge base where this has been worked out per situation.
Why it becomes difficult on paper
The problem is usually not the setup, but the maintenance. An SME concludes new SaaS subscriptions in the course of a year, stops using others, and the processor agreement that comes with it sometimes changes without anyone noticing. A spreadsheet that was correct at the start is often only a snapshot after a few months. That only becomes visible at the moment it matters: when responding to a data subject request, during a tender, or when a supervisory authority asks for it.
That is the real distinction between doing it yourself and having it supported. Keeping a record yourself is not a problem as long as there is someone who regularly takes the time to check it and update it. At many small businesses, that time exists at the start, and disappears as soon as the pressure of daily work takes over.
Doing it yourself, using a tool, or outsourcing
Between doing it entirely yourself and outsourcing it completely lies a middle ground: a system that populates the record from a library of known tools and alerts you if something is missing or has changed. That does not eliminate the thinking about what should be in it — that remains your responsibility — but it does reduce the risk that a change goes unnoticed. Whether that is worth the effort for your business depends on the number of processing activities and how often that number changes. An overview of what is involved and what it costs can be found on the page with the system's pricing.
Those who prefer to try it themselves first can simply do so. The GDPR does not require a paid system. What the law does require is that the record is at all times an accurate reflection of reality — not just on the day it was created.
What you can never outsource
Whether you keep the record in a spreadsheet or have it populated in a system: responsibility for its accuracy remains with the organisation, not with the tool. A tool can alert you that a processor agreement has expired or that a new SaaS tool has not yet been recorded, but the decision about what you do with that, and whether a processing activity is actually necessary, remains yours. For the application to your specific situation, that is something to discuss with a lawyer or, if in doubt about the law itself, with the Dutch Data Protection Authority.
Would you like to see how this works in practice before choosing between doing it yourself and getting support? You can then read the frequently asked questions about the record of processing activities or via the registration page create a business account and see the difference for yourself.
If you want to know where your business currently stands, the free quick scan is a good starting point: no obligation, just an indication of what is relevant for your situation.