Records of processing activities (Article 30 GDPR): what they are and which legal documents your website needs

If your firm or company processes personal data about clients, employees, suppliers or website users, Regulation (EU) 2016/679 (GDPR) expects more than a privacy notice: it requires you to be able to show what you do with that data. One of the central tools for that is the record of processing activities in Article 30.

What the record of processing activities is

It is a document, on paper or in electronic form, that describes in an orderly way all the personal data processing carried out by an organisation. It is not filed with any authority: it is an internal document that must be available and up to date whenever a supervisory authority, such as the Spanish Data Protection Agency (AEPD), asks for it.

Controllers must keep one and, with their own content, so must processors (Art. 30(2)). In Spain, Organic Law 3/2018 (LOPDGDD) completes the framework.

What if I have fewer than 250 employees?

The GDPR provides an exemption for organisations with fewer than 250 employees, but its conditions make it largely hollow: it does not apply where the processing is likely to result in a risk to individuals’ rights, where it is not occasional, or where it includes special categories of data or data relating to criminal convictions and offences. Any firm that handles payroll, client files or a contact database on a regular basis falls within the obligation.

What it must contain under Article 30(1)

• The name and contact details of the controller (and, where applicable, the joint controller, representative and data protection officer).
• The purposes of the processing.
• A description of the categories of data subjects and of personal data.
• The categories of recipients, including those in third countries or international organisations.
• International transfers and the safeguards applied, where relevant.
• Where possible, the envisaged time limits for erasure of the different categories of data.
• A general description of the technical and organisational security measures (Art. 32(1)).

How to build it step by step

1. Inventory your processing. Walk through every area (clients, HR, invoicing, marketing, website) and note which data is collected and why.
2. Identify the legal basis for each one (contract, legal obligation, legitimate interests, consent…). It is not a mandatory field in Article 30, but you will need it for your privacy policy.
3. List third parties: accountants, hosting providers, e-mail or analytics tools. For those acting as processors you need the Article 28 contract.
4. Define retention periods consistent with the legal obligations that apply to your activity.
5. Describe security measures in general terms: access control, backups, encryption, staff training.
6. Assign an owner to keep it up to date and set a periodic review, plus a review whenever a processing activity changes.

The legal documents your website should display

The record is internal, but the public texts on your site draw from it. At a minimum, review these:

• Legal notice: the provider identification data required by Spanish Law 34/2002 (LSSI-CE) for information society services.
• Privacy policy: the information required by Articles 13 and 14 GDPR (identity, purposes, legal basis, recipients, transfers, retention, rights and the right to lodge a complaint with the authority).
• Cookie policy: required if you use cookies or similar technologies that are not exempt, together with the consent the LSSI-CE demands.
• Terms and conditions, if you sell products or services online.

Common mistakes

• Copying another company’s record without adapting it to your real processing.
• Drafting it once and never updating it: a record that does not reflect reality is useless as proof of compliance.
• A privacy policy that says something different from the record.
• Forgetting “invisible” processing: video surveillance, whistleblowing channels, contact forms or analytics tools.

Keeping everything consistent

The biggest risk is not having no record at all, but having each text tell a different story. Centralising legal documents, versioning them and serving them from a single place — what a platform such as LegalCloud does — helps your website, privacy policy and record say the same thing and keeps a history of changes.

You can read the full text of the regulation on EUR-Lex, and the AEPD’s guides and templates at aepd.es. This article is for information only and is not a substitute for legal advice on your specific case.