We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUKArticle 30 Records

UK GDPR Article 30 Records

Controllers and processors keep different written records under Article 30. The records must reflect current processing and be available to the ICO on request.

Use this guide for implementation planning, not as a substitute for checking the consolidated UK GDPR, applicable Data Protection Act 2018 provisions, current ICO guidance, contracts, and the facts of the processing.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
Sections
4

Structured answer sets in this page tree.

Primary sources
4

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 24, 2026
Overview

creates different records for controllers and processors. A controller records purposes, categories of people and data, recipients, transfers, envisaged erasure periods where possible, and a general description of security measures; a processor records the controller relationships, processing categories, transfers, and security description. The under-250-person exception is narrow and does not cover non-occasional, risky, special-category, or criminal-offence processing.

Section 1

What should teams decide about Article 30 Records under the UK GDPR?

Classify each legal entity and processing activity as controller or processor, then use the corresponding fields. Organise controller records around purposes and data flows; organise processor records around each controller relationship and the categories of processing performed for it.

Keep the record in writing, including electronic form, and make it available to the ICO on request. Reconcile it with actual systems, privacy notices, contracts, retention schedules, DPIAs, transfer records, breach records, and security controls.

  • Controller record: controller, joint controller, representative and DPO contacts; purposes; categories of people and personal data; recipient categories; transfers and, for a transfer under the second subparagraph of Article 49(1), documentation of suitable safeguards; envisaged erasure periods where possible; and a general security-measures description.
  • Processor record: processor and each controller's contacts, representatives and DPO where applicable; processing categories for each controller; transfers and, for a transfer under the second subparagraph of Article 49(1), documentation of suitable safeguards; and a general security-measures description.
  • Record the processing at a level that distinguishes different purposes, data categories, recipients, retention, transfer routes, and risk profiles.
  • Link optional accountability fields such as lawful basis, Article 9 or 10 condition, data source, DPIA, contract, notice, consent, location, and breach record when they help keep the mandatory record accurate.
Sources for this answer
Article 30 Record of Processing Activities
ICO controller template supports Article 30 implementation by showing the record-of-processing structure controllers can use for UK GDPR documentation.
UK GDPR Article 30 - Records of processing activities
Binding source for controller and processor record fields, written form, ICO availability, and the under-250-person exception.
ICO guidance on documenting processing activities
ICO guidance explains what organisations should document under Article 30 and how to maintain processing records in existing governance practices.
Section 2

Who should own Article 30 Records, and what evidence should prove the decision?

Privacy or data governance should own the record standard and quality checks. Business and system owners should attest to purposes, data, recipients, and retention; procurement should confirm processors and subprocessors; security should maintain the control description; and legal or privacy should confirm role and transfer fields.

Treat the record as an index to controlled evidence rather than a substitute for it. Link each entry to the data map, retention rule, contract, transfer instrument, DPIA, notice, and security evidence that supports the entry.

  • Assign one named owner for each processing activity and one central owner for the record set.
  • Use controlled lists for legal entities, purposes, data categories, people, recipients, countries, systems, and retention rules without hiding material differences.
  • Record source evidence and the date each business, security, procurement, and privacy owner last confirmed the entry.
  • Use change processes for new products, purposes, vendors, countries, data categories, automated decisions, and retention changes to update the record before or when processing changes.
Sources for this answer
UK GDPR Article 30 - Records of processing activities
Article 30 assigns separate record-keeping duties to controllers and processors.
ICO guidance on documenting processing activities
ICO guidance explains what organisations should document under Article 30 and how to maintain processing records in existing governance practices.
Article 30 Record of Processing Activities
ICO processor template showing the controller-by-controller processing categories, transfer and security fields used to maintain a processor record.
Section 3

When does the under-250-person exception apply?

An enterprise or organisation employing 250 or more persons cannot use (5). One employing fewer than 250 persons is exempt only for processing that is occasional, unlikely to risk people's rights and freedoms, and does not include special-category data or criminal-conviction and offence data.

Apply the exception activity by activity. Routine customer, workforce, monitoring, or service-delivery processing is usually not occasional. If any disqualifying condition applies to an activity, document that activity even when other low-risk occasional activities qualify for the exception.

  • Do not treat employing fewer than 250 persons as a blanket exemption.
  • Do not treat regularly repeated processing as occasional merely because each event is brief.
  • Document special-category and criminal-offence processing regardless of how rarely it occurs.
  • Keep the exception analysis and evidence for any omitted activity so the scope decision can be reviewed.
Sources for this answer
Article 30 Record of Processing Activities
ICO controller template illustrating the controller fields that remain required when Article 30(5) does not exempt a processing activity.
UK GDPR Article 30 - Records of processing activities
Article 30(5) states the limited exception and each condition that removes it.
ICO guidance on documenting processing activities
ICO guidance explains what organisations should document under Article 30 and how to maintain processing records in existing governance practices.
Article 30 Record of Processing Activities
ICO processor template illustrating the processor fields that remain required when Article 30(5) does not exempt a processing activity.
Section 4

How should teams keep Article 30 records accurate?

Start with an information audit and interviews with the teams that design, buy, operate, secure, and retire processing. Compare the result with system inventories, contracts, notices, retention schedules, transfer records, DPIAs, incident records, and actual access paths.

Review on material change and on a risk-based schedule. Correct the record when purposes, systems, recipients, countries, retention, roles, security measures, or data categories change; preserve enough history to explain when and why the entry changed.

  • Require an impact check in product, vendor, data-sharing, transfer, and decommissioning workflows.
  • Compare controller and processor entries with Article 28 contracts and the controller or processor role decision.
  • Test samples against live configurations, query logs, processor lists, retention jobs, and public notices.
  • Keep an exportable written version and a documented process for responding to an ICO request.
Sources for this answer
Article 30 Record of Processing Activities
ICO controller template supports a consistent written export and review of controller processing activities.
UK GDPR Article 30 - Records of processing activities
Article 30 requires written records and availability to the ICO on request.
ICO guidance on documenting processing activities
ICO guidance explains what organisations should document under Article 30 and how to maintain processing records in existing governance practices.
Recommended next step

Assign UK GDPR Article 30 records

Assign each processing entry, supporting evidence, owner attestation, change trigger, and ICO export process.

Assessment workflow
Open Assessment Autopilot for UK GDPR

Create scoped record questions, evidence fields, and review tasks.

Explore next step
Research workflow
Review UK GDPR source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

Related guides

Explore more topics

How do you choose a lawful basis under the UK GDPR?
Choose and document the UK GDPR lawful basis that fits each processing purpose, including recognised legitimate interest, in force since 5 February 2026.
UK Children's Code: Scope and 15 Standards
Decide whether an online service is likely to be accessed by UK children and apply the ICO Children's Code standards to product design and personal-data use.
UK GDPR 72-hour Breach Reporting Guide
Decide whether a UK personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report must contain, and when individuals must be told.
UK GDPR 72-Hour Breach Reporting: Decision Guide
Decide whether a personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report needs, and when affected people must be told.
UK GDPR Adequacy Guide
Use UK transfer approval regulations by checking the destination, recipient, data, sector, effective status, scope limits, and review evidence.
UK GDPR Adequacy: When Can You Rely on It?
Check whether current UK adequacy regulations cover a restricted transfer, including partial coverage for Canada, Japan, and the US UK Extension.
UK GDPR AI and Automated Decisions Guide
Current UK GDPR rules for significant solely automated decisions, meaningful human involvement, Article 22B restrictions, and Article 22C safeguards.
UK GDPR AI and Automated Decisions: Articles 22A-22D
Apply the current UK rules for significant solely automated decisions, special-category restrictions, meaningful human involvement, and Article 22C safeguards.
UK GDPR Applicability Test Guide
Apply the UK GDPR material and territorial scope tests to one processing activity, including exclusions, non-UK organisations, roles, and evidence.
UK GDPR Article 30 Records: What to Document
See which controllers and processors need records of processing activities, what each record must contain, and how the under-250-employee exemption works.
UK GDPR Breach Notification Guide
Decide whether a personal data breach must be reported to the ICO or communicated to individuals, with deadlines, exceptions, content, and evidence.
UK GDPR Breach Workflow Guide
Run a UK GDPR personal data breach workflow from containment and awareness through risk assessment, ICO reporting, individual notice, and the breach record.
UK GDPR Children and Age Appropriate Design Guide
Apply UK GDPR children's protections and the Age Appropriate Design Code to online services likely to be accessed by children.
UK GDPR Children's Code Guide
A practical guide to Children's Code scope, its 15 standards, age 13 consent, evidence, exceptions, and product implementation.
UK GDPR Compliance Checklist
A verifiable UK GDPR checklist for scope, lawful processing, transparency, rights, governance, security, breaches, DPIAs, children, and transfers.
UK GDPR Compliance FAQ: Duties, Rights, and Decisions
Answer common UK GDPR questions on scope, lawful basis, records, DPIAs, DPOs, rights, breaches, children, automated decisions, and international transfers.
UK GDPR Compliance Guide
Build a UK GDPR compliance programme around processing records, lawful decisions, rights operations, security, incidents, DPIAs, suppliers, and transfers.
UK GDPR Controller and Processor Status Guide
Decide whether each party is a controller, joint controller, or processor under the UK GDPR, then record the role-specific duties, contract terms, and evidence.
UK GDPR Controller or Processor: How to Decide
Decide whether each party is a controller, joint controller, processor, or sub-processor, then record the contracts, responsibilities, and evidence the role requires.
UK GDPR Data Subject Rights Guide
Operate UK GDPR access, rectification, erasure, restriction, portability, objection, and automated-decision rights under the amended Article 12 timing rules.
UK GDPR Deadlines and Compliance Calendar Guide
Track UK GDPR deadlines for rights requests, privacy information, breach notification, DPIAs, and ICO prior consultation, with triggers and exceptions.
UK GDPR DPIA Workflow Guide
Screen UK GDPR processing for likely high risk, complete the required DPIA analysis before processing, reduce risk, and consult the ICO when high residual risk remains.
UK GDPR DPIA: When It Is Required and What to Record
Screen for likely high-risk processing, complete the Article 35 assessment before processing, and consult the ICO if high residual risk remains.
UK GDPR DPIAs and DPOs Guide
Decide when the UK GDPR requires a DPIA or DPO, what each must cover, when to consult the ICO, and what evidence to retain.
UK GDPR DPO: When Appointment Is Mandatory
Apply the three UK GDPR DPO triggers and document expertise, independence, reporting line, resources, tasks, contacts, and conflict controls.
UK GDPR DSAR Workflow Guide
Run a UK subject-access workflow using the current Article 12A clock, reasonable identity and clarification steps, proportionate searches, exemptions, redactions, and response evidence.
UK GDPR IDTA Addendum and Transfer Risk Assessment Guide
Choose the UK IDTA or Addendum, complete the current Article 46 data protection test, add needed measures, and maintain evidence for restricted transfers.
UK GDPR Lawful Bases Guide
Choose among the six familiar Article 6 bases and the UK's recognised legitimate interests basis, then document any Article 9 or 10 condition.
UK GDPR PECR Cookies Guide
UK GDPR and PECR cookie guidance with practical consent, exemption, evidence, and cited implementation decisions.
UK GDPR Penalties and Fines: Maximums and ICO Factors
Understand the UK GDPR £8.7 million or 2% and £17.5 million or 4% fine ceilings, which infringements fall into each band, and how the ICO sets a fine.
UK GDPR Requirements Guide
Map UK GDPR requirements by processing activity, role, lawful basis, data type, risk, rights, suppliers, automated decisions, and transfers.
UK GDPR Transfer Workflow Guide
Apply the UK GDPR restricted-transfer sequence: map the transfer, check Article 45A approval, choose an Article 46 safeguard and assessment, or justify a specific Article 49 derogation.
UK GDPR Transfers, IDTA, and UK Addendum Guide
Decide whether a UK restricted transfer exists, whether adequacy applies, how to use the IDTA or UK Addendum, and how to document the data protection test.
UK GDPR vs Data Protection Act 2018: How They Work Together
See when to use the UK GDPR, when the Data Protection Act 2018 adds a condition or exemption, and which regime covers law enforcement or intelligence processing.
UK GDPR vs EU GDPR: Scope, Regulators and Transfers
Determine whether UK GDPR, EU GDPR, or both apply, then separate representatives, regulators, transfer routes, national law, and post-Brexit UK amendments.
UK IDTA vs EU SCCs: Which Transfer Contract to Use
Choose between the UK IDTA and EU SCCs with the UK Addendum, complete the right documents, and record the separate UK and EU transfer assessments.
UK IDTA, Addendum, and Transfer Risk Assessment Guide
Decide when to use the UK IDTA or Addendum, complete the Article 46 data protection test, add supplementary measures, and keep the transfer under review.
UK vs EU GDPR Differences After the 2025 UK Reforms
Compare current UK and EU rules for recognised legitimate interests, rights requests, access searches, automated decisions, and international transfers.
UK vs EU GDPR Operations: Regulators, Breaches and Transfers
Configure separate UK and EU privacy operations for representatives, regulator contacts, rights requests, breach reporting, transfer tools, and evidence.
When do PECR cookie rules require consent?
Apply the current UK PECR rules to cookies and similar technologies, including consent, five exceptions, UK GDPR overlap, and evidence.