Record of processing activities

What it means

A record of processing activities is an internal map of what personal data the company processes, for what purpose, who receives it and how long it is kept. GDPR requires it from the controller and from the processor alike.

It is neither the privacy notice nor a data protection impact assessment. The notice on the website is written for clients and staff, the record is kept for yourself and for the authority, and an impact assessment is done only for risky processing.

The record is organised by purpose, not by system. A single client database may serve invoicing, email marketing and debt collection, and each of those purposes has its own legal basis, its own set of data and its own retention period. A record that merely lists software cannot answer that question.

How it works in practice

The exemption for companies with fewer than 250 employees is narrow: it falls away where processing is not occasional or covers special categories of data. Payroll runs regularly and carries health data, so the exemption does not reach it and the record is kept even by an employer that handed payroll to an outside firm under a processing agreement.

It is kept in writing, including electronic form, and made available to the Slovak data protection authority on request. Recipients and transfers outside the EU belong in it, which means the cloud and the external accountant too. Where a data protection officer has been appointed, the record is their first tool.

We do not guess the retention periods in the record. For accounting documents they come from the Accounting Act, for payroll sheets and pension insurance records from specific rules with a much longer period. As an accounting firm we also keep our own processor’s record covering every client whose payroll and books we process.

What to watch out for

The record is filled in once from a template and never updated afterwards. The authority asks for it first at an inspection, and the gap between the paper and the systems actually running is an infringement in its own right, punishable even where nothing ever leaked.

After a personal data breach the controller generally has 72 hours to notify the authority. Without an up-to-date record, the company cannot say in that time which categories of data and how many people the breach affected. It notifies incompletely or late, and a second infringement is added to the breach itself.