#Governance, risk and compliance

Record of processing activities: who must keep one and what goes in it (GDPR Article 30)

A client's auditor asks for your record of processing activities, and the company sends a spreadsheet from 2018 that misses half of its systems. GDPR Article 30 requires a record from every controller and processor, and the exemption for organisations under 250 employees is narrow: regular processing of employee data always belongs in the record.