Your record of processing, prefilled and in order.
Privacyboard helps you keep the record of processing activities that Article 30 of the GDPR describes. Start from 16 common activities, such as customer accounts, billing or payroll, linked to your vendors and prefilled for you to check.
Free to set up · No credit card · About 5 minutes
In short
- Templates
- 16 common activities, each prefilled
- Linked to
- The vendors that take part in each activity
- Each record
- Purpose, data, people, retention and legal basis
- Suggestions
- Activities proposed from the tools you use
Start from 16 ready-made activities
Pick the activities that match your business and edit them. No blank page.
Each activity, fully described
Purpose, people, data, legal basis, retention and recipients, with recipients linked to your vendor list.
See what still needs a look
Incomplete activities are listed with the next detail to add, and the same list feeds your overview.
What is a record of processing activities?
A record of processing activities, or processing register, lists what you do with personal data: each activity, why you do it, whose data is involved, which data, who receives it, how long you keep it and how it is protected. It is the working document behind your privacy policy.
Most small companies think it does not apply to them. The exemption for organisations under 250 people has exceptions, and it does not apply when processing is not occasional, may risk people's rights, or involves special categories of data, so many small businesses keep one.
How it works
- 1
Choose from common activities
Customer accounts, billing, support, marketing, analytics, payroll, recruitment and more. Every field comes prefilled.
- 2
Check and adjust
Confirm the purpose, the data, the people concerned, the retention and the legal basis, and link the vendors involved.
- 3
Let it feed your documents
Your privacy policy and your data processing agreement read from the register, so you answer each thing once.
What you get
16 activity templates
From customer accounts and billing to payroll, recruitment, analytics and services delivered for clients.
Suggested from your tools
Add Stripe and billing is suggested. Add an email tool and newsletters are. You add them in one click.
Your role for each activity
Mark whether you act as a controller or a processor, since the rules differ.
Retention and legal basis
Each activity carries how long data is kept and the basis you rely on, with plain explanations.
Linked vendors
Each activity shows the vendors involved, with their logos, drawn from your vendor list.
One source for your policy
The activities you record are the ones your privacy policy describes.
What Article 30 asks the record to contain
Whether you must keep a record depends on your situation. When in doubt, keeping one is a sensible default.
- Article 30(1)
- The controller's identity and contact details, the purposes of processing, the categories of people and data, the recipients, transfers outside the EEA, the planned retention periods and a general description of security measures.
- Article 30(2)
- Processors keep their own record of the processing they carry out for each controller.
- Article 30(5)
- Organisations with fewer than 250 employees are exempt only if processing is occasional and unlikely to risk people's rights, and does not include special categories or criminal data.
Questions, answered.
Do small businesses need a record of processing activities?
Often yes. The exemption for organisations under 250 employees applies only when processing is occasional, unlikely to risk people's rights and free of special categories of data. Regular processing, like customer accounts or payroll, usually means a record is needed.
What is the difference between the register and the privacy policy?
The register is your internal record, in detail. The privacy policy is the public summary for the people concerned. In Privacyboard the policy is written from the same activities.
Where do the prefilled values come from?
They are common values for each type of activity, written in plain words, and they are always yours to edit. Nothing is considered confirmed until you check it.
What if I act for clients?
Choose the processor role for that activity. Processing on behalf of clients also leads to the data processing agreement, which Privacyboard can draft.
Can I add an activity that is not in the templates?
Yes. You can add your own activity and fill in each field yourself.
Is the register free?
Yes. The register is part of the free workspace.