Lesson 4.65: Records of processing activities
Under the GDPR (Article 30) most organisations must keep a record of their processing activities: what personal data they process, why, about whom, who receives it, whether it leaves the EU and how long it's kept. The record is what a regulator asks for first, and it's also the map you need when a breach happens or a person asks for their data. In the lab you check Northwind's record: missing lawful bases, missing or indefinite retention, transfers without safeguards, and systems that process personal data but aren't in the record at all.
15 min
You will learn to
- Name the contents of a record of processing (GDPR Art. 30)
- Find activities without a lawful basis
- Find missing or indefinite retention
- Find international transfers without safeguards
- Compare the record with the system inventory
Key terms
- Record of processing activities (RoPA)
- The GDPR Article 30 inventory of what personal data an organisation processes and how.
- Lawful basis
- One of the six grounds in Article 6 that allow processing (consent, contract, legal obligation, vital interests, public task, legitimate interest).
- Storage limitation
- Personal data is kept no longer than the purpose requires.
- International transfer
- Personal data sent outside the EU/EEA; needs adequacy, standard contractual clauses or another safeguard.
- Data protection officer (DPO)
- The person who advises on and monitors compliance with data protection law.
← Patching, backups and logging: the boring controls that save you · All lessons · Reading a security culture survey →