Set by the law · GDPR Art. 30(1)
Records of processing activities
In plain English
Controllers, and processors for their part, must keep a written record of their processing activities. Organisations with fewer than 250 staff are exempt unless the processing is risky, regular or involves sensitive data.
The official text
Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility.
Each processor and, where applicable, the processor's representative shall maintain a record of all categories of processing activities carried out on behalf of a controller
The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data
66 decisions on Fino cite Article 30 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.