Records of processing activities are an internal record of what personal data a company processes, for what purpose, on what legal basis, for how long it retains it, to whom it provides it, and what security measures it applies. They are kept separately for each agenda – HR, customers, marketing, the camera system, suppliers. They are not published, but are submitted to the supervisory authority on request and tend to be the first document an inspection will request. The obligation also applies to smaller companies whenever the processing is not occasional, which in practice means almost every employer or e-shop operator. They are also useful outside of an inspection: without this overview, a company cannot reliably respond to a customer's request for erasure or access to their data.
See also: Data Protection Officer (DPO), Data subject rights, Data processing agreement.
