# What records of processing activities does the GDPR require us to keep?

Controllers and processors must keep a written record, which may be electronic, of their processing activities and make it available to the supervisory authority on request. For a controller, each entry describes the purposes, the categories of people and of personal data, the recipients, any transfers outside the EU with their safeguards, the planned deletion periods where possible, and a general description of the security measures. Processors keep a shorter record of the processing they carry out for each controller. Smaller organisations, below an employee threshold set in the GDPR, are exempt in some cases, but the exemption does not apply where processing is not occasional, which is true of almost any continuous network monitoring, or where it is likely to result in a risk or involves special categories of data. So list security monitoring as its own processing activity: purpose, data collected, who sees it, the vendor as processor, where the data is stored and for how long. NetSenX’s data processing agreement and its list of sub-processors give you the vendor facts for that entry; the record itself is yours to keep.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [EU law: GDPR, DORA, CRA and AI Act](https://netsenx.com/en/faq/eu-law) · https://netsenx.com/en/faq/what-records-of-processing-must-we-keep

## Read next

- https://netsenx.com/en/blog/2026-10-26_ai-act-nis2-dora-cra
- https://netsenx.com/en/compliance
- https://netsenx.com/en/dpa

## Related questions

- [How do NIS2, the GDPR, DORA, the CRA and the AI Act fit together?](https://netsenx.com/en/faq/how-do-nis2-gdpr-dora-cra-and-ai-act-fit-together)
- [What is the GDPR, in plain terms?](https://netsenx.com/en/faq/what-is-the-gdpr-in-plain-terms)
- [Are IP addresses personal data under the GDPR?](https://netsenx.com/en/faq/are-ip-addresses-personal-data-under-the-gdpr)
- [What counts as a personal data breach under the GDPR?](https://netsenx.com/en/faq/what-counts-as-a-personal-data-breach)
- [What is the difference between a controller and a processor under the GDPR?](https://netsenx.com/en/faq/controller-or-processor-what-is-the-difference)