UK GDPR Article 30 Records

Controllers and processors each have record-keeping duties. An organisation with 250 or more employees must document all processing activities. An organisation with fewer than 250 employees still needs to document any activity that is not occasional, is likely to result in a risk to people's rights and freedoms, or involves special-category data or criminal-conviction and offence data.

The three small-organisation conditions are alternatives. Routine payroll, customer management, service delivery, account administration, or monitoring is usually non-occasional even in a small business, so the exemption often removes little from the practical record.

A controller's record must identify the controller and relevant joint controllers, UK representative, and DPO; the purposes; categories of people and personal data; categories of recipients; international transfers and safeguards where applicable; envisaged erasure time limits where possible; and a general description of Article 32 security measures where possible.

A processor's record is narrower but still substantial. It must identify the processor and each controller it serves, relevant representatives and DPOs; the categories of processing carried out for each controller; international transfers and safeguards where applicable; and a general description of security measures where possible.

The record must describe current processing, not the intended design or an old audit snapshot. Update it when a product adds a purpose, data category, recipient, vendor, transfer, retention rule, or material security change. Product, procurement, HR, security, and legal change processes should feed the record owner.

Article 30 does not prescribe a single template. A spreadsheet, governance tool, or connected register can work if the required information is written, understandable, current, and exportable for the ICO. Preserve approval and change history where it helps show when the record changed and why.