Records of Processing and Compliance Registers

What it does

A record of processing activities in a spreadsheet is usually out of date after a few months. Our register engine keeps it as a structured, shared record that your team maintains and that the attorney or Data Protection Officer reviews and approves.

The same engine also holds other compliance registers: the AI Act register of AI systems, and registers for the NIS2 Directive and for DORA. Each entry carries an explanation that cites the article it relates to, and evidence can be attached to it. The tool organises the information. The legal assessment of what an entry should say, and whether it is complete, stays with the lawyer.

Functions

Record of processing activities (Article 30 GDPR)

Each processing activity is an entry with the elements Article 30(1) lists: the purpose, the categories of data subjects and personal data, the categories of recipients, transfers to third countries and the safeguard used, the envisaged time limits for erasure, and a general description of security measures. The register has separate views for controllers and for processors, as Article 30(2) requires a different record for processing carried out on behalf of others. See what a RoPA must contain.

Retention and transfers per entry

Retention periods, the lawful basis and the transfer mechanism are recorded with the entry, so that the choices behind them are visible and can be questioned. The point is to make retention periods and international transfers a documented decision rather than an assumption.

Other compliance registers

The register engine also keeps AI Act, NIS2 and DORA registers. For the AI Act, the register is the inventory of systems and their classification; the dedicated AI Act register and assessments build on it, and risk classification explains the categories. Which regime applies to you is a legal question that we answer first. The engine does not decide it.

Explanations that cite the articles

Fields come with a short explanation that names the relevant article, so that the person filling in the entry knows what the law asks and why. This reduces the number of incomplete entries and the number of questions to the DPO.

Evidence

Documents that support an entry, such as a processing agreement, a policy, a screenshot of a configuration or an assessment, can be uploaded and attached to the entry they prove. If the authority asks, the evidence is where the statement is.

Editing and approval

Clients edit entries in the client portal. The attorney or DPO reviews the changes and approves them. Every approved version is dated.

Processor and vendor view

Processors and vendors appear as entries linked to the processing activities they support, with the processing agreement attached. This is the view you need when you review suppliers, or when you must show who handles which data.

What you receive

• A current record of processing activities, exported as HTML or PDF, that you can hand to your supervisory authority on request.
• The same export for your AI Act, NIS2 and DORA registers, where they apply to you.
• A dated history of approved versions and attached evidence.
• A list of open points: incomplete entries, entries without a retention period, transfers without a recorded safeguard.

Example walk-through

Take an e-commerce company starting from a spreadsheet. We import the existing lines, and the engine shows which required elements are missing for each. The marketing manager completes the entries for the newsletter, the web shop and customer service in the portal, choosing retention periods and attaching the supplier agreements as evidence. The DPO reviews each entry, asks for a correction on a transfer to a US provider, and approves the set. The HTML or PDF export is dated and stored. Three months later the company adds a loyalty app: a new entry is created, flagged as awaiting approval, and the export is regenerated after the DPO signs off.

Each version stays available, so you can show what the register said at a given date, for instance when a customer audit or an authority asks about a past period.

Where it is used

The register is the base of our DPO as a Service. It is also used when we draft or review data processing agreements, because every processor belongs in the register. The registers for AI systems support our AI Act compliance work, and the entries for datasets and counterparties support data licensing and sharing.

Confidential content is redacted on our own hardware before any cloud AI sees it; if that check cannot run, nothing goes out. Our platform is hosted in the EU.