MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
A processing register is an overview of all processing of personal data within your organization. The GDPR requires most entrepreneurs to maintain one (Article 30 GDPR); it is the core of your accountability obligation.
What is a processing register?
The register catalogues which personal data you process, for what purpose, on what legal basis, with whom you share it, and how long you retain it. It does not impose any new processing activities, but makes clear and demonstrable what you do with personal data.
Are you required to keep a register?
Most organizations do. An exception applies to organizations with fewer than 250 employees, but that exception lapses if you process systematically, if the processing poses a risk to data subjects, or if you process special categories of personal data. In practice, virtually every enterprise falls under the obligation nonetheless.
What is in it?
Including: the purposes of the processing, the categories of data subjects and data, the recipients, any transfer outside the EU, the retention periods, and the security measures. Keep the register up to date if your processing operations change.
The basis for your GDPR compliance
The register is the starting point of your accountability obligation (Article 5, paragraph 2 GDPR): you must be able to demonstrate that you handle data with care. The Dutch Data Protection Authority may request the register. Furthermore, it assists you with your privacy statement, data processing agreements, and a data breach process.
Frequently Asked Questions
Does my small business need to keep a register?
Often yes: the exception for small organizations lapses in the case of structural or high-risk processing or special categories of data. In practice, the obligation usually applies.
What belongs in the register?
Purposes, categories of data subjects and data, recipients, retention periods, transfer and security measures.
Can the supervisor request it?
Yes, the Dutch Data Protection Authority can request the register as proof of your accountability obligation.
Is your processing register in order?
Our legal experts assist you with a register via a privacy scan and draft your data processing agreement . View our privacyteam or schedule a free consultation.
