More
Index
CHAPTER I General provisions (1-4)
Article 1. Subject-matter and objectivesArticle 2. Material scopeArticle 3. Territorial scopeArticle 4. Definitions
CHAPTER II Principles (5-11)
Article 5. Principles relating to processing of personal dataArticle 6. Lawfulness of processingArticle 7. Conditions for consentArticle 8. Conditions applicable to child's consent in relation to information society servicesArticle 9. Processing of special categories of personal dataArticle 10. Processing of personal data relating to criminal convictions and offencesArticle 11. Processing which does not require identification
CHAPTER III Rights of the data subject (12-23)
Article 12. Transparent information, communication and modalities for the exercise of the rights of the data subjectArticle 13. Information to be provided where personal data are collected from the data subjectArticle 14. Information to be provided where personal data have not been obtained from the data subjectArticle 15. Right of access by the data subjectArticle 16. Right to rectificationArticle 17. Right to erasure (‘right to be forgotten’)Article 18. Right to restriction of processingArticle 19. Notification obligation regarding rectification or erasure of personal data or restriction of processingArticle 20. Right to data portabilityArticle 21. Right to objectArticle 22. Automated individual decision-making, including profilingArticle 23. Restrictions
CHAPTER IV Controller and processor (24-43)
Article 24. Subject-matter and objectivesArticle 25. Data protection by design and by defaultArticle 26. Joint controllersArticle 27. Representatives of controllers or processors not established in the UnionArticle 28. ProcessorArticle 29. Processing under the authority of the controller or processor
Article 30. Records of processing activities
Article 31. Cooperation with the supervisory authorityArticle 32. Security of processingArticle 33. Notification of a personal data breach to the supervisory authorityArticle 34. Communication of a personal data breach to the data subjectArticle 35. Data protection impact assessmentArticle 36. Prior consultationArticle 37. Designation of the data protection officerArticle 38. Position of the data protection officerArticle 39. Tasks of the data protection officerArticle 40. Codes of conductArticle 41. Monitoring of approved codes of conductArticle 42. CertificationArticle 43. Certification bodies
CHAPTER V Transfers of personal data to third countries or international organisations (44-50)
Article 44. General principle for transfersArticle 45. Transfers on the basis of an adequacy decisionArticle 46. Transfers subject to appropriate safeguardsArticle 47. Binding corporate rulesArticle 48. Transfers or disclosures not authorised by Union lawArticle 49. Derogations for specific situationsArticle 50. International cooperation for the protection of personal data
CHAPTER VI Independent supervisory authorities (51-59)
Article 51. Supervisory authorityArticle 52. IndependenceArticle 53. General conditions for the members of the supervisory authorityArticle 54. Rules on the establishment of the supervisory authorityArticle 55. CompetenceArticle 56. Competence of the lead supervisory authorityArticle 57. TasksArticle 58. PowersArticle 59. Activity reports
CHAPTER VII Cooperation and consistency (60-70)
Article 60. Cooperation between the lead supervisory authority and the other supervisory authorities concernedArticle 61. Mutual assistanceArticle 62. Joint operations of supervisory authoritiesArticle 63. Consistency mechanismArticle 64. Opinion of the BoardArticle 65. Dispute resolution by the BoardArticle 66. Urgency procedureArticle 67. Exchange of informationArticle 68. European Data Protection BoardArticle 69. IndependenceArticle 70. Tasks of the BoardArticle 71. ReportsArticle 72. ProcedureArticle 73. ChairArticle 74. Tasks of the ChairArticle 75. SecretariatArticle 76. Confidentiality
CHAPTER VIII Remedies, liability and penalties (77-84)
Article 77. Right to lodge a complaint with a supervisory authorityArticle 78. Right to an effective judicial remedy against a supervisory authorityArticle 79. Right to an effective judicial remedy against a controller or processorArticle 80. Representation of data subjectsArticle 81. Suspension of proceedingsArticle 82. Right to compensation and liabilityArticle 83. General conditions for imposing administrative finesArticle 84. Penalties
CHAPTER IX Provisions relating to specific processing situations (85-91)
Article 85. Processing and freedom of expression and informationArticle 86. Processing and public access to official documentsArticle 87. Processing of the national identification numberArticle 88. Processing in the context of employmentArticle 89. Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposesArticle 90. Obligations of secrecyArticle 91. Existing data protection rules of churches and religious associations
CHAPTER X Delegated acts and implementing acts (92-93)
Article 92. Exercise of the delegationArticle 93. Committee procedure
CHAPTER XI Final provisions (94-95)
Article 94. Repeal of Directive 95/46/ECArticle 95. Relationship with Directive 2002/58/ECArticle 96. Relationship with previously concluded AgreementsArticle 97. Commission reportsArticle 98. Review of other Union legal acts on data protectionArticle 99. Entry into force and application
GDPR > Article 30. Records of processing activities
Download PDF

Article 30 GDPR. Records of processing activities

1. Each controller and, where applicable, the controller’s representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information:

(a) the name and contact details of the controller and, where applicable, the joint controller, the controller’s representative and the data protection officer;

(b) the purposes of the processing;

(c) a description of the categories of data subjects and of the categories of personal data;

(d) the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations;

ISO 27701
ISO 27701

ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 30(1)(d) GDPR:

7.5.4 Records of PII disclosure to third parties

Control

The organization should record disclosures of PII to third parties, including what PII has been disclosed, to whom and at what time.

Implementation guidance

PII can be disclosed during the course of normal operations.

[…]


to read the full text

(e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;

ISO 27701 Related
ISO 27701

ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraphs to article 30(1)(e) GDPR:

7.5.1 Identify basis for PII transfer between jurisdictions

Control

The organization should identify and document the relevant basis for transfers of PII between jurisdictions.

Implementation guidance

PII transfer can be subject to legislation and/or regulation depending on the jurisdiction or international organization to which data is to be transferred (and from where it originates).

[…]


to read the full text

Related

(f) where possible, the envisaged time limits for erasure of the different categories of data;

ISO 27701
ISO 27701

8.4.2 Return, transfer or disposal of PII

Control

The organization should provide the ability to return, transfer and/or disposal of PII in a secure manner. It should also make its policy available to the customer.

Implementation guidance

At some point in time, PII can need to be disposed of in some manner.

[…]


to read the full text

(g) where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

Related
Related

2. Each processor and, where applicable, the processor’s representative shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing:

(a) the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller’s or the processor’s representative, and the data protection officer;

(b) the categories of processing carried out on behalf of each controller;

(c) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;

ISO 27701
ISO 27701

ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII processors.

Here is the relevant paragraph to article 30(2)(c) GDPR:

8.5.2 Countries and international organizations to which PII can be transferred

Control

The organization should specify and document the countries and international organizations to which PII can possibly be transferred.

Implementation guidance

The identities of the countries and international organizations to which PII can possibly be transferred in normal operations should be made available to customers.

[…]


to read the full text

(d) where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

ISO 27701 Related
ISO 27701

ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 15.1.2.

Here is the relevant paragraph to article 30(2)(d) GDPR:

6.12.1.2 Addressing security within supplier agreements

Implementation guidance

The organization should specify in agreements with suppliers whether PII is processed and the minimum technical and organizational measures that the supplier needs to meet in order for the organization to meet its information security and PII protection obligations (see 7.2.6 and 8.2.1).

[…]


to read the full text

Related

3. The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form.

4. The controller or the processor and, where applicable, the controller’s or the processor’s representative, shall make the record available to the supervisory authority on request.

5. The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.

Guidelines & Case Law Related
Guidelines & Case Law Related
General Data Protection Regulation (EU GDPR)

The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.

Expert commentary ISO 27701 Recitals Guidelines & Case Law Leave a comment
Expert commentary

Article 30 is pretty straightforward and gives us very direct instructions on what document has to be created and what information has to be in it. Often it is enough to create a spreadsheet or a simple Excel table if the number of your processing activities is not so high, but if it doesn’t scale well, there are also specialised software solutions for Register of Processing Activities. 

[…]


to read the full text

Author
Maria Arnst CIPM, TÜV
GDPR Consultant
Ask a question
ISO 27701

ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 30 GDPR:

7.2.8 Records related to processing PII

Control

The organization should determine and securely maintain the necessary records in support of its obligations for the processing of PII.

Implementation guidance

A way to maintain records of the processing of PII is to have an inventory or list of the PII processing activities that the organization performs. Such an inventory can include:

 

[…]


to read the full text

Recitals

(13) In order to ensure a consistent level of protection for natural persons throughout the Union and to prevent divergences hampering the free movement of personal data within the internal market, a Regulation is necessary to provide legal certainty and transparency for economic operators, including micro, small and medium-sized enterprises, and to provide natural persons in all Member States with the same level of legally enforceable rights and obligations and responsibilities for controllers and processors, to ensure consistent monitoring of the processing of personal data, and equivalent sanctions in all Member States as well as effective cooperation between the supervisory authorities of different Member States. The proper functioning of the internal market requires that the free movement of personal data within the Union is not restricted or prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data. To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping. In addition, the Union institutions and bodies, and Member States and their supervisory authorities, are encouraged to take account of the specific needs of micro, small and medium-sized enterprises in the application of this Regulation. The notion of micro, small and medium-sized enterprises should draw from Article 2 of the Annex to Commission Recommendation 2003/361/EC [5].

[5] Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (C(2003) 1422) (OJ L 124, 20.5.2003, p. 36). https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2003:124:TOC

(39) Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used. That principle concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain confirmation and communication of personal data concerning them which are being processed. Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing. In particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection of the personal data. The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing.

(82) In order to demonstrate compliance with this Regulation, the controller or processor should maintain records of processing activities under its responsibility. Each controller and processor should be obliged to cooperate with the supervisory authority and make those records, on request, available to it, so that it might serve for monitoring those processing operations.

Guidelines & Case Law Leave a comment