What records of processing activities does the GDPR require us to keep?

Controllers and processors must keep a written record, which may be electronic, of their processing activities and make it available to the supervisory authority on request. For a controller, each entry describes the purposes, the categories of people and of personal data, the recipients, any transfers outside the EU with their safeguards, the planned deletion periods where possible, and a general description of the security measures. Processors keep a shorter record of the processing they carry out for each controller. Smaller organisations, below an employee threshold set in the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., are exempt in some cases, but the exemption does not apply where processing is not occasional, which is true of almost any continuous network monitoring, or where it is likely to result in a risk or involves special categories of data. So list security monitoring as its own processing activity: purpose, data collected, who sees it, the vendor as processor, where the data is stored and for how long. NetSenX’s data processing agreement and its list of sub-processors give you the vendor facts for that entry; the record itself is yours to keep.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on EU law: GDPR, DORA, CRA and AI ActAll topics