We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUKArticle 30 Records

UK GDPR Article 30 Records

Controllers and processors keep different written records under . The records must reflect current processing and be available to the ICO on request.

Use this guide for implementation planning, not as a substitute for checking the consolidated UK GDPR, applicable Data Protection Act 2018 provisions, current ICO guidance, contracts, and the facts of the processing.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
4 sections4 primary sources
Overview

creates different records for controllers and processors. A controller records purposes, categories of people and data, recipients, transfers, envisaged erasure periods where possible, and, where possible, a general description of security measures; a processor records the controller relationships, processing categories, transfers, and a security description where possible. The under-250-person exception is narrow and does not cover non-occasional, risky, special-category, or criminal-offence processing.

Section 1

What should teams decide about Article 30 Records under the UK GDPR?

Classify each legal entity and processing activity as controller or processor, then use the corresponding fields. Organise controller records around purposes and data flows; organise processor records around each controller relationship and the categories of processing performed for it.

Keep the record in writing, including electronic form, and make it available to the ICO on request. Reconcile it with actual systems, privacy notices, contracts, retention schedules, DPIAs, transfer records, breach records, and security controls.

  • Controller record: controller, joint controller, representative and DPO contacts; purposes; categories of people and personal data; recipient categories; transfers and, for a transfer under the second subparagraph of Article 49(1), documentation of suitable safeguards; envisaged erasure periods where possible; and, where possible, a general security-measures description.
  • Processor record: processor and each controller's contacts, representatives and DPO where applicable; processing categories for each controller; transfers and, for a transfer under the second subparagraph of Article 49(1), documentation of suitable safeguards; and, where possible, a general security-measures description.
  • Record the processing at a level that distinguishes different purposes, data categories, recipients, retention, transfer routes, and risk profiles.
  • Link optional accountability fields such as lawful basis, Article 9 or 10 condition, data source, DPIA, contract, notice, consent, location, and breach record when they help keep the mandatory record accurate.
Section 2

Who should own Article 30 Records, and what evidence should prove the decision?

Privacy or data governance should own the record standard and quality checks. Business and system owners should attest to purposes, data, recipients, and retention; procurement should confirm processors and subprocessors; security should maintain the control description; and legal or privacy should confirm role and transfer fields.

Treat the record as an index to controlled evidence rather than a substitute for it. Link each entry to the data map, retention rule, contract, transfer instrument, DPIA, notice, and security evidence that supports the entry.

  • Assign one named owner for each processing activity and one central owner for the record set.
  • Use controlled lists for legal entities, purposes, data categories, people, recipients, countries, systems, and retention rules without hiding material differences.
  • Record source evidence and the date each business, security, procurement, and privacy owner last confirmed the entry.
  • Use change processes for new products, purposes, vendors, countries, data categories, automated decisions, and retention changes to update the record before or when processing changes.
Section 3

When does the under-250-person exception apply?

An enterprise or organisation employing 250 or more persons cannot use (5). One employing fewer than 250 persons is exempt only for processing that is occasional, unlikely to risk people's rights and freedoms, and does not include special-category data or criminal-conviction and offence data.

Apply the exception activity by activity. Routine customer, workforce, monitoring, or service-delivery processing is usually not occasional. If any disqualifying condition applies to an activity, document that activity even when other low-risk occasional activities qualify for the exception.

  • Do not treat employing fewer than 250 persons as a blanket exemption.
  • Do not treat regularly repeated processing as occasional merely because each event is brief.
  • Document special-category and criminal-offence processing regardless of how rarely it occurs.
  • Keep the exception analysis and evidence for any omitted activity so the scope decision can be reviewed.
Section 4

How should teams keep Article 30 records accurate?

Start with an information audit and interviews with the teams that design, buy, operate, secure, and retire processing. Compare the result with system inventories, contracts, notices, retention schedules, transfer records, DPIAs, incident records, and actual access paths.

Review on material change and on a risk-based schedule. Correct the record when purposes, systems, recipients, countries, retention, roles, security measures, or data categories change; preserve enough history to explain when and why the entry changed.

  • Require an impact check in product, vendor, data-sharing, transfer, and decommissioning workflows.
  • Compare controller and processor entries with Article 28 contracts and the controller or processor role decision.
  • Test samples against live configurations, query logs, processor lists, retention jobs, and public notices.
  • Keep an exportable written version and a documented process for responding to an ICO request.
Recommended next step

Assign UK GDPR Article 30 records

Assign each processing entry, supporting evidence, owner attestation, change trigger, and ICO export process.

Assessment workflow
Open Assessment Autopilot for UK GDPR

Create scoped record questions, evidence fields, and review tasks.

Explore next step
Research workflow
Review UK GDPR source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

UK GDPR Article 30 - Records of processing activities
legislation.gov.uk5 citations
Referenced sections
  • Binding source for controller and processor records, written form, ICO access, and the under-250-person exception.
  • Binding source for controller and processor record fields, written form, ICO availability, and the under-250-person exception.
  • Article 30 assigns separate record-keeping duties to controllers and processors.
Show 2 more
  • Article 30(5) states the limited exception and each condition that removes it.
  • Article 30 requires written records and availability to the ICO on request.
Article 30 Record of Processing Activities
ico.org.uk4 citations
Referenced sections
  • Supports this page's Article 30 Records analysis under the UK GDPR.
  • ICO controller template supports Article 30 implementation by showing the record-of-processing structure controllers can use for UK GDPR documentation.
  • ICO controller template illustrating the controller fields that remain required when Article 30(5) does not exempt a processing activity.
Show 1 more
  • ICO controller template supports a consistent written export and review of controller processing activities.
Article 30 Record of Processing Activities
ico.org.uk3 citations
Referenced sections
  • Supports this page's Article 30 Records analysis under the UK GDPR.
  • ICO processor template showing the controller-by-controller processing categories, transfer and security fields used to maintain a processor record.
  • ICO processor template illustrating the processor fields that remain required when Article 30(5) does not exempt a processing activity.

Related guides

UK GDPR 72-hour Breach Reporting Guide

Decide whether a UK personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report must contain, and when individuals must be told.

UK GDPR Adequacy Guide

Use UK transfer approval regulations by checking the destination, recipient, data, sector, effective status, scope limits, and review evidence.

UK GDPR AI and Automated Decisions Guide

Current UK GDPR rules for significant solely automated decisions, meaningful human involvement, Article 22B restrictions, and Article 22C safeguards.

UK GDPR Applicability Test Guide

Apply the UK GDPR material and territorial scope tests to one processing activity, including exclusions, non-UK organisations, roles, and evidence.

UK GDPR Breach Notification Guide

Decide whether a personal data breach must be reported to the ICO or communicated to individuals, with deadlines, exceptions, content, and evidence.

UK GDPR Breach Workflow Guide

Run a UK GDPR personal data breach workflow from containment and awareness through risk assessment, ICO reporting, individual notice, and the breach record.

Show all related guides (40)

UK GDPR Children and Age Appropriate Design Guide

Apply UK GDPR children's protections and the Age Appropriate Design Code to online services likely to be accessed by children.

UK GDPR Children's Code Guide

A practical guide to Children's Code scope, its 15 standards, age 13 consent, evidence, exceptions, and product implementation.

UK GDPR Compliance Checklist

A verifiable UK GDPR checklist for scope, lawful processing, transparency, rights, governance, security, breaches, DPIAs, children, and transfers.

UK GDPR Compliance FAQ: Duties, Rights, and Decisions

Answer common UK GDPR questions on scope, lawful basis, records, DPIAs, DPOs, rights, breaches, children, automated decisions, and international transfers.

UK GDPR Compliance Guide

Build a UK GDPR compliance programme around processing records, lawful decisions, rights operations, security, incidents, DPIAs, suppliers, and transfers.

UK GDPR Controller and Processor Status Guide

Decide whether each party is a controller, joint controller, or processor under the UK GDPR, then record the role-specific duties, contract terms, and evidence.

UK GDPR Data Subject Rights Guide

Operate UK GDPR access, rectification, erasure, restriction, portability, objection, and automated-decision rights under the amended Article 12 timing rules.

UK GDPR Deadlines and Compliance Calendar Guide

Track UK GDPR deadlines for rights requests, privacy information, breach notification, DPIAs, and ICO prior consultation, with triggers and exceptions.

UK GDPR DPIA Workflow Guide

Screen UK GDPR processing for likely high risk, complete the required DPIA analysis before processing, reduce risk, and consult the ICO when high residual risk remains.

UK GDPR DPIAs and DPOs Guide

Decide when the UK GDPR requires a DPIA or DPO, what each must cover, when to consult the ICO, and what evidence to retain.

UK GDPR DSAR Workflow Guide

Run a UK subject-access workflow using the current Article 12A clock, reasonable identity and clarification steps, proportionate searches, exemptions, redactions, and response evidence.

UK GDPR IDTA Addendum and Transfer Risk Assessment Guide

Choose the UK IDTA or Addendum, complete the current Article 46 data protection test, add needed measures, and maintain evidence for restricted transfers.

UK GDPR Lawful Bases Guide

Choose among the six familiar Article 6 bases and the UK's recognised legitimate interests basis, then document any Article 9 or 10 condition.

UK GDPR PECR Cookies Guide

UK GDPR and PECR cookie guidance with practical consent, exemption, evidence, and cited implementation decisions.

UK GDPR Penalties and Fines: Maximums and ICO Factors

Understand the UK GDPR £8.7 million or 2% and £17.5 million or 4% fine ceilings, which infringements fall into each band, and how the ICO sets a fine.

UK GDPR Requirements Guide

Map UK GDPR requirements by processing activity, role, lawful basis, data type, risk, rights, suppliers, automated decisions, and transfers.

UK GDPR Transfer Workflow Guide

Apply the UK GDPR restricted-transfer sequence: map the transfer, check Article 45A approval, choose an Article 46 safeguard and assessment, or justify a specific Article 49 derogation.

UK GDPR Transfers, IDTA, and UK Addendum Guide

Decide whether a UK restricted transfer exists, whether adequacy applies, how to use the IDTA or UK Addendum, and how to document the data protection test.

UK GDPR vs Data Protection Act 2018: How They Work Together

See when to use the UK GDPR, when the Data Protection Act 2018 adds a condition or exemption, and which regime covers law enforcement or intelligence processing.

UK GDPR vs EU GDPR: Scope, Regulators and Transfers

Determine whether UK GDPR, EU GDPR, or both apply, then separate representatives, regulators, transfer routes, national law, and post-Brexit UK amendments.

UK IDTA vs EU SCCs: Which Transfer Contract to Use

Choose between the UK IDTA and EU SCCs with the UK Addendum, complete the right documents, and record the separate UK and EU transfer assessments.

UK vs EU GDPR Differences After the 2025 UK Reforms

Compare current UK and EU rules for recognised legitimate interests, rights requests, access searches, automated decisions, and international transfers.

UK vs EU GDPR Operations: Regulators, Breaches and Transfers

Configure separate UK and EU privacy operations for representatives, regulator contacts, rights requests, breach reporting, transfer tools, and evidence.

How do you choose a lawful basis under the UK GDPR?

Choose and document the UK GDPR lawful basis that fits each processing purpose, including recognised legitimate interest, in force since 5 February 2026.

UK Children's Code: Scope and 15 Standards

Decide whether an online service is likely to be accessed by UK children and apply the ICO Children's Code standards to product design and personal-data use.

UK GDPR 72-Hour Breach Reporting: Decision Guide

Decide whether a personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report needs, and when affected people must be told.

UK GDPR Adequacy: When Can You Rely on It?

Check whether current UK adequacy regulations cover a restricted transfer, including partial coverage for Canada, Japan, and the US UK Extension.

UK GDPR AI and Automated Decisions: Articles 22A-22D

Apply the current UK rules for significant solely automated decisions, special-category restrictions, meaningful human involvement, and Article 22C safeguards.

UK GDPR Article 30 Records: What to Document

See which controllers and processors need records of processing activities, what each record must contain, and how the under-250-employee exemption works.

UK GDPR Controller or Processor: How to Decide

Decide whether each party is a controller, joint controller, processor, or sub-processor, then record the contracts, responsibilities, and evidence the role requires.

UK GDPR DPIA: When It Is Required and What to Record

Screen for likely high-risk processing, complete the Article 35 assessment before processing, and consult the ICO if high residual risk remains.

UK GDPR DPO: When Appointment Is Mandatory

Apply the three UK GDPR DPO triggers and document expertise, independence, reporting line, resources, tasks, contacts, and conflict controls.

UK IDTA, Addendum, and Transfer Risk Assessment Guide

Decide when to use the UK IDTA or Addendum, complete the Article 46 data protection test, add supplementary measures, and keep the transfer under review.

When do PECR cookie rules require consent?

Apply the current UK PECR rules to cookies and similar technologies, including consent, five exceptions, UK GDPR overlap, and evidence.