UK GDPR Article 30 Records

Start by deciding whether the issue affects controller/processor roles, lawful basis, transparency, DPIA, data-subject rights, breach notification, IDTA/Addendum transfers, children data, or ICO enforcement exposure. The useful answer should name the exact trigger, affected product or process, required action, owner, evidence, and escalation point.

Under Article 30, controllers and, where applicable, their representatives must keep records of processing activities, while processors and, where applicable, their representatives must keep records of categories of processing carried out on behalf of a controller.

Ownership should sit with the team that controls the processing purpose, system behavior, vendor terms, transfer mechanism, rights channel, breach process, or child-user journey.

Evidence should show role mapping, lawful basis, Article 9/10 basis where needed, transparency wording, DPIA outcome, DSAR response, breach assessment, transfer mechanism, processor terms, and ICO escalation note.

Most UK GDPR mistakes happen at the boundary between UK GDPR, DPA 2018, PECR, EU GDPR divergence, IDTA/Addendum transfer rules, children data, and processor/subprocessor duties.

Use this section before approving a new processing purpose, vendor, transfer, profiling flow, DSAR workflow, breach process, or child-facing product change.

Use a UK GDPR workflow that captures role, purpose, lawful basis, special-category status, DPIA trigger, rights/breach/transfer trigger, evidence, owner, and review date.

The output should be a lawful-basis note, DPIA decision, privacy notice update, DSAR record, breach assessment, transfer pack, processor clause map, or ICO response record.