The record of processing activities is the first document a supervisory authority asks for. It is also the link between data protection and the AI Act: every entry can be tied to an AI system, turning two separate lists into one view where you see the processing for each system – and the system for each processing activity.

At a glance

Included from: Professional
Where in the app: Data protection → Records of processing
Output: A complete register, exportable as CSV and part of the full GDPR export
Legal basis: Art. 30 GDPR
API: /api/v1/processing-records

What an entry contains

Area	Fields
Purpose and legal basis	Name, purpose, legal basis and supporting notes. Those notes are effectively mandatory for legitimate interest – that is where the authority expects the balancing test.
Data subjects and data	Categories of data subjects, data categories and – kept separately – special categories under Art. 9. Plus the data source.
Recipients and transfer	Recipient categories, a third country transfer flag with safeguards, and the list of processors involved, taken from the vendor register.
Retention	Retention period as text and additionally in days, plus the deletion concept. The value in days feeds the retention schedule view.
Controllership	Role (controller, joint controller, processor), name and address of the controller, competent supervisory authority, responsible person with email.
Automated decision-making	A flag plus a description. This is where Art. 22 GDPR and the AI Act meet – when this says "yes", the system almost always carries heightened requirements.
Security and review	Summary of the technical and organizational measures, the linked AI system, next review date and date of last review.

Legal bases

Six fixed values: the same as in Art. 6(1) GDPR, no free text. A processing activity can rest on several bases; the app keeps them as a list.

Value	Meaning
CONSENT	Consent of the data subject.
CONTRACT	Performance of a contract or pre-contractual steps.
LEGAL_OBLIGATION	Compliance with a legal obligation.
VITAL_INTERESTS	Protection of vital interests.
PUBLIC_INTEREST	Task carried out in the public interest.
LEGITIMATE_INTERESTS	Legitimate interest. The balancing test belongs in the notes here – without it the entry is incomplete.

Status model

Status	Meaning
DRAFT	In progress – not yet part of the presentable register.
IN_REVIEW	Under review by the data protection officer or the business unit.
APPROVED	Approved and valid. This is the state an entry should be in.
ARCHIVED	Processing discontinued. The entry stays – accountability does not end when the processing does.

The gap list

A dedicated view shows every AI system that has no processing record yet. That is the fastest route to a complete register: you work through a list instead of guessing what is missing.

Links are validated

References to an AI system or to processors must belong to your organization. An ID that does not exist, or belongs to another organization, makes the save fail – the entry is not stored with a dangling reference.

Further Art. 30 details

Besides the basic fields, an entry records what an authority asks when it looks closer:

Several legal bases per processing activity, for special categories the exception under Art. 9(2)(a)–(j), for criminal-offence data the basis under Art. 10.
National bases (Sec. 22, 24, 26(1) and (3) BDSG) and the specific provision for a legal obligation.
Balancing test for legitimate interests, with a separate text for the privacy notices.
Device access under Sec. 25 TDDDG (consent or strictly necessary), minors with age verification.
Recipient types, transfer mechanism, module of the standard contractual clauses and the Art. 49 case for third-country transfers.
Result of the DPIA screening: it feeds into the DPO requirement check.
Master data of the controller and, where relevant, the EU representative come from the profile in the data protection officer area.

Templates

For typical processing activities there are 18 templates that pre-fill an entry with purpose, categories, legal bases and periods: payroll, personnel file, time tracking, recruiting, business travel, CRM and sales, customer accounting, customer app, remote maintenance and IoT, customer training, website hosting, website analytics, website embeds, contact form, newsletter, IT operations, video surveillance and group shared services. Check and adapt every template to your actual processing.

Retention period library

For the retention period the app offers a library of statutory periods (as of 1 January 2025). "Take over from library" sets the text and days; check the period for your records. The provisions are German law.

Entry	Provision
Accounting vouchers	Sec. 147(1) no. 4, (3) AO; Sec. 257(1) no. 4, (4) HGB
Books and annual accounts	Sec. 147(1) no. 1, (3) AO; Sec. 257(1) no. 1, (4) HGB
Business letters	Sec. 147(1) nos. 2, 3, (3) AO; Sec. 257(1) nos. 2, 3, (4) HGB
Payroll account	Sec. 41(1) sentence 9 EStG; Sec. 147(3) AO
Job applications	Sec. 15(4) AGG; Sec. 61b(1) ArbGG
Working time records	Sec. 16(2) ArbZG
Personnel file	Sec. 195, 199 BGB (standard limitation period)
Server logs with IP addresses	Art. 5(1)(c), (e) GDPR
Video recordings	Art. 5(1)(c), (e), Art. 17 GDPR; German DPA guidance
Double opt-in proof	Art. 7(1) GDPR; Sec. 7(2) no. 2 UWG; Sec. 195 BGB