Processing records for personal data

Almost everyone who works with personal data is obliged to keep a so-called processing record of the processing activities, which is an important tool to fulfill the responsibility obligation.

Companies and organisations with fewer than 250 employees are exempted from the obligation to keep processing records for certain processes.

• The exemption is however very narrow and therefore it is rare that it is fully applicable.

As a rule, undertakings and organisations with under 250 employees are therefore obliged to keep a processing record if the processing:

• is likely to pose a risk to the rights and freedoms of registered individuals;

• is not incidental, or

• it includes sensitive personal data or information relating to criminal convictions and criminal offences