Template Records of data processing activities & AI Records (en)

Here you can find our template for the records of data processing activities. Every company that processes personal data (= every company there is) needs such a document - ideally before the first data are processed. This is not legally required, but a company has to prove it surveys all data processing activities. For this the records of data processing activities is an ideal tool. If you don’t have one, you risk hefty fines when the data processing administration knocks on your door or when there is even an audit.

The records of data processing activities is a super spreadsheet for any and all data processing regarding all data subjects related to the company. It applies internally and externally, so not only to customers and website visitors, but also to employees, applicants, suppliers, freelancers etc. It is important to understand why, on which legal basis and how long each data category is (and may be) processed. Therefore, I recommend creating records of data processing activities from the start and updating them constantly. Incidentally, this sheet is an ideal basis to draft privacy policies.

As a second sheet we added the AI records. These records are not required legally either, but highly recommended as well. The AI records list any AI tools that you use in your company, be it internally or externally. There may be overlaps between the two records if an AI tool processes personal data as well. In that case the provider is also a data processor under the GDPR: Depending on the risk this may even require a data processing impact assessment.

Please check and update the two records regularly.

You need to adapt several yellow markings in the template. Also, please read the comments carefully.