To the ones who maintain the record of processing when nobody asks

Over the summer, a department introduced a tool for online appointment booking. It works, citizens and customers are happy, the invoices arrive monthly. Nobody told data protection, not on purpose, but because nobody thought of it.

In October, the data protection coordinator goes through the list of running contracts, as she does every quarter, without anyone having asked her to. She finds the new provider, calls the department and adds the processing activity: which data, for what purpose, who sees it, where the provider is based, when it is deleted. Half an hour of work. Nobody thanks her, because nobody knows about it.

What is missing when it is missing

As long as everything runs, nothing is missing. The record only shows its gaps when it is needed: when someone requests access to their data and nobody knows the tool exists. When the provider reports a data breach and it first has to be established what data is stored there at all. Or when the supervisory authority requests the record and it shows the state of the last audit.

Where it is required

Art. 30(1) GDPR is brief: each controller and, where applicable, its representative shall maintain a record of processing activities under its responsibility. In German:

„Jeder Verantwortliche und gegebenenfalls sein Vertreter führen ein Verzeichnis aller Verarbeitungstätigkeiten, die ihrer Zuständigkeit unterliegen.“

Then follows the list of what belongs in it: purposes, categories of data subjects and data, recipients, transfers to third countries, where possible retention periods and a general description of the technical and organisational measures. Paragraph 4 says what for: the record is made available to the supervisory authority on request. On request means: at a time you do not choose.

The exemption for organisations with fewer than 250 employees in paragraph 5 rarely helps. It does not apply if the processing is not occasional, and customer, staff or citizen data is usually processed more than occasionally.

Why nobody sees it

A record that is maintained looks exactly like one that is out of date. Both have a cover page, both have rows, both pass a quick glance. The difference only shows in the row that is missing, and that is only noticed by someone who checks regularly without anyone asking.

There is no date on which this is due and no report in which it appears. That is exactly why it depends on people who do it anyway.

To them

To the ones who briefly ask themselves with every new invoice whether there is data in it. Who call the department instead of waiting for a notification. And who keep a record that is correct on the day of the request, not just on the day of the audit.

Sources

Regulation (EU) 2016/679 (GDPR), Art. 30(1), (4) and (5), consolidated version including corrigenda, retrieved on 30.10.2026.

In the next part: to the ones who delete a firewall rule instead of adding the next one. The previous part: To the ones who justify "not applicable" instead of ticking it.