Records of processing activities
Almost every Article 30 record is a spreadsheet that was accurate on the day it was made. The duty is to maintain it, and maintenance is what a spreadsheet is worst at.
What the law requires
Article 30 of the UK GDPR requires controllers and processors to maintain a record of processing activities under their responsibility, containing specified information — purposes, categories of data subject and personal data, recipients, transfers, retention periods where possible, and a general description of security measures. The record must be in writing, including electronic form, and made available to the Information Commissioner on request. The exemption for organisations with fewer than 250 employees is narrow: it does not apply where the processing is likely to result in a risk to individuals, is not occasional, or includes special category or criminal offence data.
Legislation referred to on this page: UK GDPR Article 30. Named so you can read the source. Nothing on this page is legal advice, and whether a duty applies to your organisation is a question for you and your adviser.
Who it applies to
- Controllers and processors alike, with different required content for each role.
- The under-250 exemption is much narrower than it is usually assumed to be — routine employee data processing is not occasional.
- The record has to be produced on request, which makes "we could reconstruct it" the wrong plan.
What you have to be able to show
The list an inspector, insurer or auditor actually works through.
- The record itself, covering each processing activity.
- Purposes, categories of individuals and of data, and recipients.
- Retention periods, and evidence that disposal actually happens.
- International transfers and the safeguards relied on.
- When each entry was last reviewed.
How DutyHub records it
DutyHub does not carry out any of the work below. It records who did, when, and what they found.
Entries with review dates
Each processing activity carries its own review cycle, so the record ages visibly instead of silently.
Suppliers linked to activities
A processor is recorded against the activities it touches, so a supplier change surfaces the entries it affects.
Retention that actually runs
Retention is a scheduled disposal against the records themselves, not a column in a document nobody acts on.
Start with what applies to you
Add your premises and answer a short set of questions about them. DutyHub works out which duties land on which building, and shows you the gaps before anybody else finds them.
Check your Martyn's Law tier — free See pricing