In short. Almost everyone: the 250-employee threshold (Article 30(5) GDPR) is emptied of substance by its three exceptions — processing likely to result in a risk, processing that is not occasional, special categories of data or data relating to criminal convictions and offences — which bring almost all controllers back within the obligation: a single employee is enough. The record must be in writing, including in electronic form; infringements are punishable by fines of up to 10 million euros or, for undertakings, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4)(a)).
It is widely believed that the record of processing activities is an obligation reserved for larger organisations, because of the 250-employee threshold. This is a misunderstanding as common as it is treacherous: read in full, the rules lead to the opposite conclusion. For most of those who process personal data, the record is in fact the very precondition of compliance with Regulation (EU) 2016/679. It is therefore worth clarifying what it is, who is subject to the obligation, what its required content is and in what form it must be kept and updated.
What the record of processing activities is
The record of processing activities is founded on Article 30 of Regulation (EU) 2016/679 (GDPR). It consists, in short, of a documentary mapping of all the personal data processing carried out by an organisation: for each activity it sets out the purposes pursued, the categories of data subjects and of data, the recipients, the retention periods and the security measures adopted.
It is not a mere formality. The record is one of the defining tools of the accountability principle: anyone who processes data must be able to demonstrate that they do so in compliance with the rules. Without an up-to-date picture of the processing carried out, it becomes hard to assess risks, respond to data subjects’ requests or manage a personal data breach. It is no coincidence that the Regulation requires the record to be made available to the supervisory authority on request (Article 30(4)).
Who is required to keep the record
It is on this point that the most common uncertainty in application arises. Article 30(5) of the Regulation introduces, on the face of it, a favourable threshold: the obligation does not apply to organisations with fewer than 250 employees. The same provision, however, immediately follows with three exceptions that bring almost all controllers back within the obligation.
Even below the threshold, the record must be kept by anyone who:
- carries out processing likely to result in a risk — even if not a high one — to the rights and freedoms of data subjects;
- carries out processing that is not occasional;
- processes special categories of data (the data that Article 9 GDPR classifies as sensitive: health, biometric and genetic data, religious or political beliefs and the like) or data relating to criminal convictions and offences (Article 10 GDPR).
The decisive exception is the second. “Occasional processing” means a sporadic, unplanned activity; conversely, the ordinary management of customer, supplier and employee data is by its nature systematic and continuous. Anyone with even a single employee processes that person’s data on a stable basis for payroll and statutory purposes. It follows that the 250-employee threshold, in practice, is relevant only in entirely residual cases: this is confirmed by the breadth of the list of obliged parties that the Italian Data Protection Authority (Garante) itself sets out in its official FAQs on the subject.
The cases indicated by the Authority
To convey how broad the pool of obliged parties is, the Garante lists, among others:
- shops and tradespeople with at least one employee — bars, restaurants, workshops, stores — or who process customers’ health data, such as beauticians, hairdressers and opticians;
- self-employed professionals with at least one employee, or who process health data or data relating to criminal convictions and offences: think of accountants, physiotherapists, pharmacists and, in general, doctors;
- associations, foundations and committees that process special categories of data (sports associations, for the health data they process, bodies protecting vulnerable people and the like);
- even condominiums, where they process special categories of data, as in the case of resolutions on the removal of architectural barriers.
Precisely because these exceptions are so broad, the Garante recommends that all controllers and processors keep the record, even where it is not mandatory, in line with recital 82 of the Regulation: it is a simple tool, useful for governing the processing and for a cooperative dialogue with the Authority.
Do I have to keep one? The typical cases in a table
| Situation | Record | Why |
|---|---|---|
| Bar, shop, workshop or practice with at least one employee | Yes | Payslips and statutory obligations are processing that is not occasional |
| Professional without employees who processes health or judicial data (physiotherapist, pharmacist) | Yes | Special categories of data or data on convictions and offences |
| Online shop run by one person | Yes, as a rule | Orders, shipping and newsletters are continuous activities, not occasional ones |
| Sports association that collects medical certificates | Yes | Data concerning health |
| Condominium | Only in some cases | Needed if it processes special categories of data (for example, resolutions on architectural barriers) |
| Supplier working on its clients’ data (IT support, payroll processing) | Yes, as a processor | It processes data on behalf of others on a continuous basis: it keeps the record under Article 30(2) |
| Public body (municipality, school, health authority) | Yes | Systematic processing, often of special categories of data |
The table gives guidance; it does not replace an analysis of the specific case. The rows on the online shop, the supplier and the public body are not examples given by the Garante: they apply the same criteria as Article 30(5). In doubtful cases three questions are enough: is the processing habitual? Does it concern sensitive data? Can it entail a risk for individuals? A single yes triggers the obligation.
The simplification for SMEs
Organisations with fewer than 250 employees that are subject to the obligation may limit the record to the processing activities that trigger it, without mapping their entire operations. The Garante makes available on its website two “simplified record” templates for SMEs, one for the controller and one for the processor. They are a good starting point, provided they are adapted to the organisation’s actual situation: a template filled in generically is of little use.
Is the 250-employee threshold about to change?
Perhaps, but not yet. On 21 May 2025 the European Commission proposed rewriting Article 30(5): the exemption would apply to enterprises and organisations with fewer than 750 employees, and the obligation would remain only for processing likely to result in a high risk within the meaning of Article 35. In Joint Opinion 01/2025 (July 2025) the European Data Protection Board and the European Data Protection Supervisor shared the objective, but asked for the choice of 750 rather than 500 employees to be justified and recalled that the record also serves other obligations, such as transparency and responding to data subjects’ requests. On 9 June 2026 the Council and the European Parliament reached a provisional agreement on the simplification package (“Omnibus IV”) of which the proposal forms part; the GDPR is among the acts covered by the agreement.
A provisional agreement is not a rule in force: the new rules will apply only after formal adoption and publication in the Official Journal of the European Union, and the final threshold, which may change in the negotiations compared with the proposal, must be read in the final text. Until then the current Article 30 applies, with its three exceptions. Even afterwards, the record will remain useful to anyone who has to demonstrate how they process data: scrapping an existing one would be a saving in appearance only.
What the record must contain
The minimum content is precisely set by Article 30(1) of the Regulation. The controller’s record must contain, for each processing operation:
- the name and contact details of the controller and, where appointed, of any joint controller, the representative and the data protection officer (DPO);
- the purposes of the processing, broken down by type (for example: managing the employment relationship of staff; managing orders to suppliers). It is advisable also to set out the legal basis under Article 6;
- the categories of data subjects and of personal data: the people involved (customers, suppliers, employees) and the type of data processed (identification, health, biometric data and so on);
- the categories of recipients to whom the data have been or will be disclosed, including external parties appointed as processors;
- any transfers to third countries or international organisations, indicating the country and the safeguards provided;
- the retention periods, that is the time limits envisaged for erasing the various categories of data; where no time limit can be fixed, the criteria for determining it must be indicated;
- a general description of the technical and organisational security measures adopted under Article 32. The list in Article 32 is open-ended: it is for the controller to assess, in practice, the level of security appropriate to the risks.
It should be made clear that the last two items — the retention periods and the description of the security measures — are required by Article 30(1)(f) and (g) “where possible”: filling them in nonetheless remains good practice, and the Garante’s FAQs treat both fields as content to be set out in the record.
There is nothing to prevent the inclusion of further useful information, such as the data protection impact assessments (DPIAs) carried out or the internal contacts identified for certain processing.
The controller’s record and the processor’s record
Article 30 distinguishes two documents. The controller’s record (paragraph 1) describes the processing decided on and carried out by the organisation for its own purposes. The processor’s record (paragraph 2), by contrast, concerns those who process data on behalf of others — an IT service provider, a payroll company, a software house — and lists the categories of activities carried out for each client controller.
Anyone acting as a processor for several clients will have to organise their record into separate sections, one for each controller, and may, in describing the processing, refer to what is already set out in the appointment act, which under Article 28 must specify the nature, purposes, types of data, categories of data subjects and duration of the processing. It should be added that the same party may be a controller for some processing and a processor for others: in such cases both records are needed.
In what form it is kept and how it is updated
The record must be in writing, including in electronic form. No set format is prescribed: a suitably structured spreadsheet or a text document will do, provided the content meets the requirements of Article 30. On request, it must be produced to the Authority.
The most delicate aspect concerns updating. The record is a “living” document: it must correspond, at all times, to the processing actually carried out. Any significant change — a new purpose, a new category of data or of data subjects, a new external supplier — must be recorded straight away. This is why the Garante’s FAQs ask that the record show, in a verifiable way, the date on which it was first set up (or on which each entry was created) and the date of the last update, with notes such as “entry created on…” and “last updated on…”. A record that is not up to date does not fulfil its function.
A sample completed entry
This is how the “personnel management” entry might look in the controller’s record of a small business with eight employees. It is an example to be adapted, not a template to be copied.
| Item | Content |
|---|---|
| Purposes | Management of the employment relationship: hiring, attendance, pay, social security and tax obligations |
| Legal basis | Performance of the employment contract; legal obligations; for health data, obligations in the field of employment and social security law (Article 9(2)(b)) |
| Data subjects | Employees and collaborators; dependent family members |
| Data processed | Identification, contractual and pay data, bank details; health data (sickness absences, fitness for the job) |
| Recipients | Payroll consultant (processor), social security and insurance bodies, tax authorities, bank |
| Transfers outside the EU | None |
| Retention | Duration of the relationship; after it ends, for the periods laid down by the rules on employment, social security and tax, indicated document by document |
| Security measures | Access restricted to the personnel office, individual credentials, regular backups, locked cabinets for paper documents |
| Dates | Entry created on 3 March 2025; last updated on 15 September 2026 |
Every entry follows the same logic: one purpose per entry, never an undifferentiated list of “customer data”.
How to set it up: five steps and indicative timing
For a small organisation the work is normally measured in weeks, not months. The timing is indicative: it depends on the number of offices, software programs and suppliers.
- Take stock of the processing (one or two weeks). Start from the actual activities: who collects data, with which forms and software, for what purpose. An interview with each office and the list of software in use bring almost everything to light.
- List the suppliers that have access to the data. Payroll consultant, IT support, cloud services, the agency that runs the website: each must be entered among the recipients and must have a processor contract (data processing agreement).
- Fill in one entry for each purpose (a few days). With the items required by Article 30, the legal basis and the dates.
- Check consistency with the other documents. What is written in the record must match the privacy notices, the appointments and the retention periods declared.
- Schedule the maintenance. An update whenever something changes (new software, new supplier, new purpose) and a full review at least once a year, with the date noted.
The most common mistakes
A few mistakes recur regularly in practice:
- Believing oneself exempt because of the 250 employees. This is the most widespread misunderstanding: as seen, the exceptions in Article 30(5) involve almost everyone.
- Adopting a generic template and failing to update it. A record reproduced in a standardised way and never revised does not reflect reality and will not withstand an inspection.
- Confusing purposes and legal bases, or neglecting the latter. Indicating the legal basis of each processing operation is what makes the record genuinely useful.
- Describing security measures vaguely, or, conversely, declaring there are none. The measures must be stated in summary, but consistently with what is actually in place.
- Omitting the processor’s record. Those who process data on behalf of others are often unaware that it even exists.
- Not dating creation and updates. Without such notes it is impossible to demonstrate that the record has been kept over time.
What you risk: the penalty framework
On the penalty side, infringing the obligations on the record falls within the band set by Article 83(4)(a) of the Regulation: up to 10 million euros or, for undertakings, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher. It is the “lower” band compared with that reserved for the most serious infringements (Article 83(5)), but anything but symbolic.
It should be noted, moreover, that an infringement of Article 30 may not be charged on its own: as the first of the cases examined below shows, the failure to keep the record, or its inadequacy, may emerge in the context of broader investigations and contribute, together with other shortcomings, to defining the seriousness of the conduct and the amount of the fine.
What the case law says
This is confirmed by the Garante’s decision no. 278 of 17 December 2020 (web doc. no. 9529527), which imposed a fine of 100,000 euros on Azienda USL Toscana Sud Est. Among the various infringements found, at the time of the investigation the body had not yet adopted the record of processing activities under Article 30; to this were added an act designating a processor without the instructions required by Article 28, inadequate security measures and the failure to carry out the data protection impact assessment.
The timing aspect is particularly instructive. The body had adopted the record only on 30 November 2018, three days after the inspection. The Garante observed that the obligation ran from the date on which the Regulation became fully applicable (25 May 2018) and that the two preceding years were meant precisely for getting into compliance: the late fulfilment, therefore, did not rule out the infringement of Article 30, which is among those declared in the decision and was taken into account in setting the fine. It confirms a principle as elementary as it is binding: the record must be set up and kept up to date in good time, not reconstructed after the fact, once the investigation is already under way.
A more recent decision shows the other side of the matter. By decision no. 755 of 18 December 2025 (web doc. no. 10213711) the Garante fined 120,000 euros a company that, through telematics devices installed on company vehicles, collected data on its employees’ driving style. The record was there: the investigation showed that it had been drawn up and was updated in the first three months of each year. The fine concerned other matters — an inadequate privacy notice, a legitimate interest not properly balanced, data made accessible to third parties not designated as processors, safeguards on the remote monitoring of workers not activated — and the data protection impact assessment produced by the company was itself found not to be usefully assessable. The message is clear: the record is necessary, not sufficient. It helps if it describes processing that is, in turn, lawful and consistently documented.
The record is not a document to fill in and file away: it is a mirror of how an organisation governs personal data. Keeping it carefully today makes it possible to act with confidence tomorrow — in responding to a data subject, managing a data breach or facing an inspection. Drawing it up correctly, or putting an existing one back in order, is an essential part of the GDPR compliance of businesses, professionals and organisations; the record also brings to light the processing that requires a data protection impact assessment (DPIA). To set up the record or review an existing one, we offer support as part of our GDPR advice for businesses and professionals. On the same theme, the article on the cookie banner may also be useful.
Frequently asked questions
Does the 250-employee threshold exempt you from the record? Almost never: the three exceptions in Article 30(5) — processing that poses a risk to rights, processing that is not occasional, special categories of data or data relating to criminal convictions and offences — bring almost all controllers back within the obligation. The ordinary management of customer, supplier and employee data is, by its nature, not occasional.
Does a self-employed professional without employees have to keep the record? Yes, if they process health data or data relating to criminal convictions and offences: it is one of the cases indicated by the Garante. In other cases the obligation depends on whether the processing is not occasional, and the habitual management of clients’ data is rarely occasional: keeping the record is the most prudent choice, as well as the one recommended by the Garante.
In what form must the record be kept? In writing, including in electronic form: a suitably structured spreadsheet or text document is adequate, provided its content meets the requirements of Article 30 and the record can be produced to the Authority on request.
Must someone who processes data on behalf of others keep one too? Yes: the processor keeps the record under Article 30(2), organised by client controller. Since the same party may be a controller for some processing and a processor for others, in such cases both records are needed.
Will the threshold rise to 750 employees? That is what the European Commission proposed on 21 May 2025, limiting the obligation to high-risk processing; on 9 June 2026 the Council and the European Parliament reached a provisional agreement on the package of which the proposal forms part. Until the new text has been adopted, published in the Official Journal of the European Union and become applicable, the 250-employee threshold and the three current exceptions apply.
This article is for information purposes and reflects the rules in force at the date of publication; it does not replace an assessment of the specific case.
This article is for general information only and is not legal advice on any specific case. Content reviewed by Giuseppe Foti, legal consultant — last checked on September 30, 2026.