Records of Processing Activities

Records of Processing Activities are formal logs that document how an organization processes personal data. They list categories of data, purposes, lawful bases, retention periods and data recipients to prove compliance with data protection law.

What is Records of Processing Activities

This is a practical register used by HR teams to track employee and candidate data flows. It explains in plain terms what personal data is processed, why it is processed, who has access and how long it is kept.

How does it work

Teams create or update the record when processes change, such as a new recruitment tool or payroll vendor. The record helps assess risk, respond to data subject requests and support audits.

Practical usage in HR

Where and why this is used in organisations:

• Recruitment: documenting applicant data collected and retention periods.
• Payroll: recording data transfers to payroll providers and tax authorities.
• Compliance: demonstrating lawful basis and retention for audits and investigations.

Examples and scenarios

Examples include logging background check data flows, updating records when switching HRIS vendors, and mapping employee access to sensitive data during reorganisations.

Related HR concepts

Closely related terms include GDPR, data protection impact assessment, data subject rights, retention policy, data controller and data processor.