--- title: "Records of Processing and Compliance Registers | Pitch" description: "One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or…" url: https://www.pitch.law/technologies/privacy-register --- [pitch](https://www.pitch.law/) [Technology](https://www.pitch.law/technologies) [Privacy, data & AI](https://www.pitch.law/technology-categories/privacy-data-ai) # Records of Processing and Compliance Registers One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval. ## What it does A record of processing activities in a spreadsheet is usually out of date after a few months. Our register engine keeps it as a structured, shared record that your team maintains and that the attorney or Data Protection Officer reviews and approves. The same engine also holds other compliance registers: the AI Act register of AI systems, and registers for the NIS2 Directive and for DORA. Each entry carries an explanation that cites the article it relates to, and evidence can be attached to it. The tool organises the information. The legal assessment of what an entry should say, and whether it is complete, stays with the lawyer. ## Functions ### Record of processing activities (Article 30 GDPR) Each processing activity is an entry with the elements Article 30(1) lists: the purpose, the categories of data subjects and personal data, the categories of recipients, transfers to third countries and the safeguard used, the envisaged time limits for erasure, and a general description of security measures. The register has separate views for controllers and for processors, as Article 30(2) requires a different record for processing carried out on behalf of others. See [what a RoPA must contain](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know). ### Retention and transfers per entry Retention periods, the lawful basis and the transfer mechanism are recorded with the entry, so that the choices behind them are visible and can be questioned. The point is to make [retention periods](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) and [international transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) a documented decision rather than an assumption. ### Other compliance registers The register engine also keeps AI Act, NIS2 and DORA registers. For the AI Act, the register is the inventory of systems and their classification; the dedicated [AI Act register and assessments](https://www.pitch.law/technologies/ai-act-governance-toolkit) build on it, and [risk classification](https://www.pitch.law/academy/ai-act-risk-classification-explained) explains the categories. Which regime applies to you is a legal question that we answer first. The engine does not decide it. ### Explanations that cite the articles Fields come with a short explanation that names the relevant article, so that the person filling in the entry knows what the law asks and why. This reduces the number of incomplete entries and the number of questions to the DPO. ### Evidence Documents that support an entry, such as a processing agreement, a policy, a screenshot of a configuration or an assessment, can be uploaded and attached to the entry they prove. If the authority asks, the evidence is where the statement is. ### Editing and approval Clients edit entries in the client portal. The attorney or DPO reviews the changes and approves them. Every approved version is dated. ### Processor and vendor view Processors and vendors appear as entries linked to the processing activities they support, with the processing agreement attached. This is the view you need when you review suppliers, or when you must show who handles which data. ## What you receive - A current record of processing activities, exported as HTML or PDF, that you can hand to your supervisory authority on request. - The same export for your AI Act, NIS2 and DORA registers, where they apply to you. - A dated history of approved versions and attached evidence. - A list of open points: incomplete entries, entries without a retention period, transfers without a recorded safeguard. ### Example walk-through Take an e-commerce company starting from a spreadsheet. We import the existing lines, and the engine shows which required elements are missing for each. The marketing manager completes the entries for the newsletter, the web shop and customer service in the portal, choosing retention periods and attaching the supplier agreements as evidence. The DPO reviews each entry, asks for a correction on a transfer to a US provider, and approves the set. The HTML or PDF export is dated and stored. Three months later the company adds a loyalty app: a new entry is created, flagged as awaiting approval, and the export is regenerated after the DPO signs off. Each version stays available, so you can show what the register said at a given date, for instance when a customer audit or an authority asks about a past period. ## Where it is used The register is the base of our [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service). It is also used when we draft or review [data processing agreements](https://www.pitch.law/solutions/data-processing-agreements), because every processor belongs in the register. The registers for AI systems support our [AI Act compliance](https://www.pitch.law/solutions/ai-act-compliance) work, and the entries for datasets and counterparties support [data licensing and sharing](https://www.pitch.law/solutions/data-licensing-sharing). Confidential content is redacted on our own hardware before any cloud AI sees it; if that check cannot run, nothing goes out. Our platform is hosted in the EU. ## In short - GDPR record of processing activities (Article 30) - AI Act, NIS2 and DORA registers on the same engine - Explanations that cite the relevant articles - Evidence uploads attached to entries - HTML and PDF export, approved by the attorney or DPO ## Related solutions - [Solutions](https://www.pitch.law/solutions/dpo-as-a-service) ### [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service) [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://www.pitch.law/solutions/dpo-as-a-service) - [Solutions](https://www.pitch.law/solutions/data-processing-agreements) ### [Data Processing Agreements](https://www.pitch.law/solutions/data-processing-agreements) [Article 28 GDPR agreements drafted, reviewed and negotiated for controllers and processors, including sub-processors and international transfers.](https://www.pitch.law/solutions/data-processing-agreements) - [Solutions](https://www.pitch.law/solutions/ai-act-compliance) ### [AI Act Compliance](https://www.pitch.law/solutions/ai-act-compliance) [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://www.pitch.law/solutions/ai-act-compliance) - [Solutions](https://www.pitch.law/solutions/data-licensing-sharing) ### [Data Licensing and Data Sharing](https://www.pitch.law/solutions/data-licensing-sharing) [Licence or share data with a clear scope, settled ownership of derived data, privacy safeguards and terms that protect its value.](https://www.pitch.law/solutions/data-licensing-sharing) ## Background reading - [Academy](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) ### [Records of Processing Activities (RoPA)](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) [What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful.](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) - [Academy](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) ### [How Long May You Keep Personal Data?](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) [The storage limitation principle in Article 5(1)(e) GDPR, how to set retention periods and how to delete in practice.](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) - [Academy](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) ### [International Data Transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) [How Chapter V GDPR works after Schrems II: adequacy decisions, the EU-US Data Privacy Framework, standard contractual clauses and the assessment that goes with them.](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) - [Academy](https://www.pitch.law/academy/ai-act-risk-classification-explained) ### [AI Act Risk Classification](https://www.pitch.law/academy/ai-act-risk-classification-explained) [How to tell whether an AI system is prohibited, high-risk, subject to transparency duties or free of specific obligations under the AI Act.](https://www.pitch.law/academy/ai-act-risk-classification-explained) - [Academy](https://www.pitch.law/academy/ai-act-compliance-timeline) ### [AI Act Timeline: What Applies When](https://www.pitch.law/academy/ai-act-compliance-timeline) [The application dates of the AI Act as of October 2026, including the postponement of the high-risk rules adopted in 2026.](https://www.pitch.law/academy/ai-act-compliance-timeline) - [Academy](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) - [Academy](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) ### [AI in HR and Recruitment](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) [Which AI tools in recruitment and people management are prohibited or high-risk under the AI Act, what employers must do, and how national labour law and the GDPR add to it.](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) - [Academy](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) ### [The AI Literacy Obligation](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) [Article 4 of the AI Act has applied since February 2025 to every company using AI. What it requires, how the 2026 amendment changed it and what to document.](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) - [Academy](https://www.pitch.law/academy/building-an-ai-governance-framework) ### [Building an AI Governance Framework](https://www.pitch.law/academy/building-an-ai-governance-framework) [What an internal AI governance framework consists of, which legal duties it must carry, and how a mid-sized organisation can build one in proportion to its use of AI.](https://www.pitch.law/academy/building-an-ai-governance-framework) - [Academy](https://www.pitch.law/academy/conformity-assessments-high-risk-ai-systems) ### [Conformity Assessments for High-Risk AI](https://www.pitch.law/academy/conformity-assessments-high-risk-ai-systems) [What a provider of a high-risk AI system must demonstrate before market entry under the AI Act, which assessment route applies and what follows afterwards.](https://www.pitch.law/academy/conformity-assessments-high-risk-ai-systems) - [Academy](https://www.pitch.law/academy/cookie-compliance-and-consent-management) ### [Cookies and Consent](https://www.pitch.law/academy/cookie-compliance-and-consent-management) [When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together.](https://www.pitch.law/academy/cookie-compliance-and-consent-management) - [Academy](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) ### [Data Subject Access Requests](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) [How the right of access works under Article 15 GDPR, how to handle the deadline, what you may refuse and what a good response contains.](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) - [Academy](https://www.pitch.law/academy/eu-ai-act-practical-overview-for-businesses) ### [The EU AI Act: a Practical Overview](https://www.pitch.law/academy/eu-ai-act-practical-overview-for-businesses) [What the AI Act regulates, who it applies to, how the risk-based approach works and what the penalties are, as of October 2026.](https://www.pitch.law/academy/eu-ai-act-practical-overview-for-businesses) - [Academy](https://www.pitch.law/academy/provider-vs-deployer-ai-act) ### [Provider or Deployer?](https://www.pitch.law/academy/provider-vs-deployer-ai-act) [The AI Act allocates duties by role. Who counts as provider, deployer, importer or distributor, and when does a deployer become a provider?](https://www.pitch.law/academy/provider-vs-deployer-ai-act) - [Academy](https://www.pitch.law/academy/website-technology-audits-and-gdpr) ### [Website Technology Audits and the GDPR](https://www.pitch.law/academy/website-technology-audits-and-gdpr) [What a website technology audit examines, why privacy notices and actual data flows drift apart, and which legal duties it checks.](https://www.pitch.law/academy/website-technology-audits-and-gdpr) ## More in Privacy, data & AI - ### [AI Act Register and Assessments](https://www.pitch.law/technologies/ai-act-governance-toolkit) [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://www.pitch.law/technologies/ai-act-governance-toolkit) - ### [Data Breach Handling](https://www.pitch.law/technologies/breach-response-workflow) [A GDPR Article 33 and 34 workflow with a 72-hour countdown, a reference per breach and a structured notification to the supervisory authority, approved by a lawyer.](https://www.pitch.law/technologies/breach-response-workflow) - ### [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) - ### [Data Subject Requests](https://www.pitch.law/technologies/dsar-handling) [Requests from individuals are logged in the client portal, tracked against the deadline and fulfilled with a data export and, for erasure, a cascade across linked records.](https://www.pitch.law/technologies/dsar-handling) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)