Processing Register

A processing register is a structured overview in which your organization records all processing activities involving personal data. For each processing activity, the register describes what data you collect, why you do so, who has access, how long you retain the data, and with which parties you share the data. Since the implementation of the GDPR in May 2018, maintaining a record of processing activities has been mandatory for all organizations with more than 250 employees and for smaller organizations that carry out high-risk processing activities. For most small and medium-sized enterprises (SMEs), this means in practice that a record is required.

How a processing register works in practice

You build a processing register around processing activities, not around individual pieces of data. A processing activity is a specific action for which you use personal data, such as processing job applications, sending newsletters, or maintaining customer data in your CRM. For each activity, you document the purpose you’re pursuing, the legal basis you’re relying on, the categories of personal data you collect, and with whom you share it. You also specify the technical and organizational measures you’re taking to protect the data. In practice, many small and medium-sized businesses start with a spreadsheet or a template from the Dutch Data Protection Authority. Later, larger organizations switch to specialized software that links the register to other compliance processes.

Why the GDPR Requires a Record of Processing Activities

The legislature introduced the processing register to make organizations aware of their data processing activities and to enable oversight and accountability. Before the GDPR, many companies processed personal data without a clear overview of what data they were collecting and why. This made it difficult to manage risks and safeguard the rights of data subjects. The register requires organizations to consider the necessity, proportionality, and security of each processing activity. During an inspection by the Dutch Data Protection Authority, the processing register is the first document requested. If the register is missing or incomplete, you run the risk of a fine or an order subject to a penalty payment.

What a processing register offers to small and medium-sized businesses

A well-maintained processing register not only helps you stay compliant but also gives you control over your data flows. At a glance, you can see which systems and vendors have access to personal data, where vulnerabilities lie, and where you’re missing data processing agreements. This makes it easier to quickly identify and report a data breach. You can also use the register as a checklist when onboarding new employees or implementing new tools. In practice, we’ve noticed in our projects involving search engine optimization and web development that a clear processing register speeds up discussions about tracking, analytics, and cookie banners. You’ll know exactly what data you’re already processing and what new processing activities you need to add when, for example, you introduce a new CRM system or marketing automation tool.

A processing register is not a static document that you fill out once and then forget about. It is a living tool that you use for various processes within your organization. Below, we describe four specific situations in which a processing register adds value for small and medium-sized businesses.

Preparing for an inspection or audit by the Dutch Data Protection Authority

The Dutch Data Protection Authority (AP) conducts random inspections and may also launch an investigation based on complaints. In both cases, the DPA will first request your processing inventory. A complete and up-to-date inventory demonstrates that you take the GDPR seriously and that you have a clear understanding of your processing activities. If the inventory is missing or contains significant gaps, this will weigh heavily in the assessment. In practice, we see that companies with a well-organized register can more quickly demonstrate compliance during an audit, which reduces the likelihood of a fine. Additionally, the register helps you provide quick answers to questions about specific processing activities, retention periods, or security measures.

Responding to requests from data subjects under the GDPR

Under the GDPR, individuals have the right to access, rectification, erasure, and data portability. If a client or employee submits such a request, you must respond within one month. A processing register helps you quickly determine which systems and processes contain that individual’s data. Without a register, you’d have to manually search all departments and tools, which is time-consuming and increases the risk of errors. With a clear register, you can check for each processing activity whether the data subject is included and what actions you need to take. This is a particularly important advantage for ecommerce stores with thousands of customers and for B2B service providers with complex CRM structures.

Onboarding of new tools, systems, or suppliers

Every time you introduce a new marketing tool, CRM, accounting system, or hosting provider, you may be processing new categories of personal data or sharing existing data with a new party. The processing register forces you to think in advance about the impact on privacy. You verify whether the new processing aligns with your existing purposes and legal bases, whether you need a data processing agreement, and what security measures the supplier provides. In our projects involving web development and AI automation, we regularly see that the lack of a register leads to compliance issues discovered after the fact—for example, when a new chatbot or analytics tool unexpectedly collects sensitive data.

When a processing register is the right choice—and when it isn’t

A processing register is mandatory for all organizations that routinely process personal data, unless you have fewer than 250 employees and only perform occasional, low-risk processing activities. In practice, this means that virtually every small and medium-sized business (SMB) with a website, ecommerce store, CRM, or HR system must maintain a register. Even sole proprietorships that send out newsletters or store customer data in a spreadsheet are subject to this requirement. A processing register is not the right choice if you’re looking for a tool to monitor data flows in real time or to perform automated compliance checks. For that, you’ll need additional software. The register is an overview; it is not a security tool or a workflow engine.