Home › Free tools › Record of processing
Article 30 asks for a written record of what you do with personal data. Every free version of this is an empty spreadsheet, which is the hard part left undone. This starts you with the activities most companies actually run, marks which fields the Article requires and which everyone adds anyway, and tells you where the record is still thin. It fills itself in from your vendor register if you have one, and nothing leaves this tab.
Runs in your browser. Nothing is sent anywhereArticle 30(1)(a). If you are established outside the UK or the EEA but offer goods or services into it, you may also need a representative named here.
Article 30(2)(a) and (b): a processor's record names each controller it acts for and the categories of processing done for them.
Start from one of these and correct it. Each comes filled in with a purpose, the categories usually involved and a retention period that is plausible rather than invented, because the blank page is the reason most of these records never get written.
Press an activity to open it. A field marked required is one Article 30 names; where possible means the Article says exactly that; expected means it is not in Article 30 but a supervisory authority will look for it.
Article 30(5) exempts organisations employing fewer than 250 people, but only if all three of the following are true. Answering them from what you have entered above.
The record is held in this browser on this device and is never transmitted. A finished record is a map of everywhere your organisation holds personal data, which is exactly the sort of document that should not be typed into somebody else's server in order to produce it.
Probably yes. Article 30(5) exempts organisations under 250 people, but only if the processing is occasional, carries no risk to people's rights, and involves no special category or criminal offence data. Those are three separate tests and you have to pass all of them. Paying staff every month is not occasional. Keeping customer accounts is not occasional. Holding sickness records is special category data. In practice almost every trading company fails at least one test, which is why the exemption is much narrower than its headline suggests. The tool works through the three tests with you rather than asserting an answer.
For a controller: who you are and how to contact you, the purposes of the processing, the categories of data subjects and of personal data, the categories of recipients including any in other countries, any transfers to a third country and the safeguard relied on, and, where possible, retention periods and a general description of your security measures. Lawful basis is not on that list. Most supervisory authorities expect it anyway and most templates include it, so this asks for it and marks it honestly as expected rather than required.
It starts from a library of the activities most companies run, each already filled in with a realistic purpose, the categories involved and a retention period, for you to correct rather than compose. Then it checks each activity against the Article 30 field list and tells you which ones are still incomplete. A template cannot do the second thing, and the first thing is where the afternoon goes.
If you have used the vendor and DPA register on this device, your vendors appear as recipients you can tick against each activity, rather than being typed again. It also does a check no template can: if an activity discloses personal data to a vendor your own register says has no data processing agreement, that is flagged. Article 30 made you write down the disclosure; Article 28 says there should be a contract behind it.
No. It produces the document Article 30 asks you to keep and makes it harder to leave obvious gaps in. Whether your processing is lawful is a different question that a form cannot answer, and anything claiming otherwise is selling something. If you process special category data at scale, monitor people systematically, or are unsure whether you need a data protection officer or an impact assessment, that is a conversation with somebody qualified, not a page.
No. The record is held in this browser's local storage on this device and is never transmitted. That matters here because a completed record is a map of everywhere your organisation holds personal data, which is not a document to hand to a third party in order to write it. The button at the bottom deletes it.