A record of processing for a small Irish business: what goes in it, and whether you need one

Article 30(1) of the GDPR requires each controller to keep a record of the processing activities it is responsible for. The controller is whoever decides why and how the data is used (the purposes and means, Article 4(7)). For a business's own staff, customers and marketing, that is the business itself. Processors keep their own record, covered further down.

Article 30(5) lifts both duties from smaller organisations, with three exceptions. In full, the obligations "shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10."

The Regulation does not say how to count the 250. Recital 13 points to the EU's SME definition in Commission Recommendation 2003/361/EC, whose Annex counts staff in annual work units, with part-time and seasonal work as fractions. For a business of ten people the count changes nothing.

The Article 29 Working Party's position paper on that paragraph, endorsed by the European Data Protection Board on 25 May 2018, reads the three exceptions as alternatives: any one alone brings the duty back, and the first means any risk, not only a high one. Its example is staff, whose data a small organisation is likely to process regularly, so that processing is not occasional and must be in the record. "Occasional", in the paper, means not carried out regularly and outside the regular course of business. Only the activities the exceptions catch need recording, so a one-off activity can stay out if it is unlikely to result in a risk and involves no special category or criminal offence data.

The DPC's guidance note on records gives Irish examples of each exception. A risk: mortgage applications, the use of artificial intelligence, tracking a person's location. Not occasional: HR and pay-related processing for employees. Special category or criminal offence data: Garda vetting, trade union membership, biometric data. Smaller organisations, it says, may not need a full record, but most will need to record HR and payroll.

Health data is special category data under Article 9(1). Article 4(15) and Recital 35 cover data revealing information about a person's physical or mental health, including medical history and clinical treatment. That takes in sick leave records that reveal a condition, a clinic's treatment notes and an allergy noted on a booking.

The exemption lifts the Article 30 record and nothing else. The duty to be able to show you comply (accountability, Article 5(2)) applies at any size, and Article 33(5) requires every personal data breach to be documented. The record is not filed with anybody. The GDPR ended the old duty to tell the regulator about processing (Recital 89). Article 30(4) requires the record to be made available to the DPC when it asks.

Article 30(1) says the record "shall contain all of the following information", and Article 30(3) requires it in writing, which includes electronic form. Points (a) and (e) say "where applicable", and points (f) and (g) say "where possible". That does not mean you can leave them blank. The DPC found the University of Limerick's record infringed Article 30(1) partly because it described no security measures. The middle column is the Regulation's wording.

The DPC's guidance note followed a sweep of thirty organisations' records in early 2022. Organise the record by function, such as HR, finance and marketing, so that nothing is missed. Go into detail: retention periods, for instance, are likely to differ by category of data. Useful extras include your legal reason for each use (the Article 6 lawful basis), the Article 9 condition for special category data, breaches, the transfer mechanism and a risk rating. Mark which columns Article 30 requires and which are extras.

The record has to stand on its own: no links the DPC cannot open, such as a retention schedule on an internal drive, no undefined acronyms, and no record that only points at other documents. The DPC did not accept one organisation's data protection impact assessments as its record. It also says that sending it a template or a sample is not enough, because Article 30 requires the record the business itself keeps. A record still naming the Privacy Shield for transfers to the US is its example of an out-of-date entry.

Keep it current and ready to send. The DPC calls the record a living document: add new products or services as they roll out, and mark or archive activities that stop. Some organisations in its sweep missed the ten days it allowed; the guidance says ten days should be sufficient notice for any organisation in all circumstances. It may also ask for the record while handling a breach notification, a complaint or an inquiry.

For a small organisation, the DPC says a simple spreadsheet may be sufficient, provided it is a standalone record the DPC can read.

In 2025 the DPC reviewed supermarket and convenience store chains. Its annual report says one controller's record did not comply with Article 30(1)(c) and (d), because it was based on a UK template and did not adequately reflect processing specific to Ireland. Some controllers did not initially provide their record when asked.

Slane Credit Union, with five permanent staff, is the small-organisation case (January 2022). Its data inventory left out member data in the directors' area of its website, and did not record why new members' account details went to the directors or how long they were kept. The DPC found Articles 24 and 30(1) infringed. It rated the Article 30(1) infringement as light and not intentional, and reprimanded the credit union. The €5,000 fine was for the security failure under Articles 5(1)(f) and 32(1). The decision does not discuss the under-250 exemption. What the plugin cost the credit union has the rest.

The University of Limerick decision of December 2025 shows what a record can leave out. From May 2018 to May 2020 its record had no description of security measures and did not adequately describe the personal data on the university's email accounts, including those that were breached. UL said its policies held the information; the DPC found they did not describe it adequately either. Of €98,000 in fines, with a reprimand, €3,000 was for Article 30(1). The rest was for security (Articles 5(1)(f) and 32(1), €45,000), notifying three breaches late (Article 33(1), €35,000) and not telling the people affected by two high-risk breaches without undue delay (Article 34(1), €15,000).

The ceiling for an Article 30 failure, under Article 83(4)(a), is €10 million or, for an undertaking, 2% of worldwide annual turnover, whichever is higher.

A processor handles personal data on behalf of a controller. A business doing that for clients keeps a processor record, under the same under-250 exemption. The DPC suggests starting with each controller and the data processed for it. A business can be a controller for its own staff and customers and a processor for its clients' data, with a record for each role.

The processor record covers points (a), (e) and (g) of the controller's record, and names each controller it acts for. In place of points (b) to (d), it lists the categories of processing carried out for each controller.

These rows are examples, not a survey, for a business of about ten people with staff on payroll, a booking system, a website and a mailing list. Keep the rows that describe what you do, add what is missing, and write each from the systems you use. Each is carried out regularly in the ordinary course of business, so none is occasional under the Working Party's test.

The table leaves out two columns your record needs: whether any data leaves the EEA and to which country (point (e)), and a short description of the security for each activity (point (g)). The notes on transfers and security say what goes in them.

Payroll. The categories and the first three recipients follow the DPC's own examples (Table A and Approach A); the payroll software or bureau is added because it holds the data.

HR records. The DPC calls "HR" on its own too vague a purpose, hence two lines. Sick leave that reveals a health condition is special category data, so the line is in the record twice over.

Staff email and shared files. The University of Limerick's record did not take account of the personal data on its email accounts.

Customer bookings. A clinic's treatment notes and a recorded allergy are health data, which puts the activity in the record a second time, as with sick leave. Large-scale processing of such data also needs a data protection impact assessment (Article 35(3)(b)); whether you need one is a separate test.

Email marketing. Where you rely on consent, Article 7(1) requires you to be able to demonstrate it, which is why the line records when and how each person signed up. Who you may email is covered separately.

CCTV. The DPC's CCTV guidance says the record should include any use of CCTV and its data protection risks, with your CCTV assessment kept in your records, and asks you to check the recorder's default retention against that assessment. Footage goes to An Garda Síochána on a formal written request saying a criminal matter is being investigated (a verbal one if urgent, followed up in writing), and you keep a record of each request and the footage provided. The DPC's example record for protected disclosures (whistleblowing reports) lists Gardaí among the recipients if offences are discovered, which is why the CCTV line includes them. CCTV for a small business covers the rest.

Website analytics. The DPC's cookie guidance says that where cookies involve personal data, each type of processing goes in the Article 30 record. Where an outside consent tool keeps the record of consent, it says you keep a record of that consent as part of your Article 30 record. What your website sets before anyone clicks accept shows how to check.

Transfers. The DPC's example of a transfer under point (e) is information sent to a processor based outside the EEA; the record names the country. Sending personal data to the US covers the basis for it.

AI tools. The DPC gives the use of artificial intelligence as an example of processing likely to result in a risk, so staff putting customer or employee data into an AI tool needs its own line. An AI use policy sets the rules.

Security. A sentence per system: two-step sign-in, access limited to the people who need it, encryption, staff training, backups with a tested restore.

Each step uses what the one before it found.

On 21 May 2025 the European Commission proposed raising the Article 30(5) threshold to fewer than 750 persons, in COM(2025) 501, known as Omnibus IV. The text Parliament and the Council agreed on 26 June 2026, approved by Parliament's committees on 2 July 2026, sets it at fewer than 1000. A record would be needed only for a specific activity likely to result in a high risk as Article 35 uses the term. It would always be needed for a core activity that requires a data protection officer under Article 37(1)(b) or (c). Its recitals say special category data processed under employment law would not as such need one unless assessed as high risk.

If it is adopted as agreed, payroll and HR would not as such need a record, and a business of ten people with no high-risk processing would keep none. The text amends GDPR Articles 4, 30(5), 40(1) and 42(1) only, leaving the accountability duty in Article 5(2) as it is.

It is not law. On 16 October 2026 the Legislative Observatory showed procedure 2025/0130(COD) "Awaiting Parliament's position in 1st reading", with 23 November 2026 as the indicative plenary date. The amending regulation would enter into force on the twentieth day after its publication in the Official Journal; until then, Article 30(5) applies as quoted above. The separate Digital Omnibus, COM(2025) 837, as the Commission proposed it on 19 November 2025, amends other GDPR articles but not Article 30, and on 16 October 2026 it was awaiting a committee decision in Parliament.