Template Records of data processing activities (en)

Here you can find our template for the records of data processing activities. Every company that processes personal data (= every company there is) needs such a document - ideally before the first data are processed. This is not legally required, but a company has to prove it surveys all data processing activities. For this the records of data processing activities is an ideal tool. If you don’t have one, you risk hefty fines when the data processing administration knocks on your door or when there is even an audit.

The records of data processing activities is a super spreadsheet for any and all data processing regarding all data subjects related to the company. It applies internally and externally, so not only to customers and website visitors, but also to employees, applicants, suppliers, freelancers etc. It is important to understand why, on which legal basis and how long each data category is (and may be) processed. Therefore, I recommend creating records of data processing activities from the start and updating them constantly. Incidentally, this sheet is an ideal basis to draft privacy policies.

You need to adapt several yellow markings in the template. Also, please read the comments carefully.