GDPR
GDPR record of processing activities in Luxembourg: obligations and content
Quick answer
The record of processing activities provided for in article 30 of the GDPR lists all of an organisation's personal data processing operations. In Luxembourg, it is in principle mandatory for every controller and every processor. The under-250-employee exception is very limited and almost never exempts an organisation from keeping one.
The record of processing activities is the central document of GDPR compliance: it maps each personal data processing operation with its purposes, legal bases, recipients and retention periods. Provided for by article 30 of the GDPR, it applies to the controller and to the processor alike. The exception for organisations with fewer than 250 employees is in reality narrow and falls away as soon as there is regular processing or sensitive data. This guide details the mandatory content, the method for building it, keeping it up to date, its link with the data protection impact assessment (DPIA) and inspections by the CNPD. For support, see our GDPR lawyer page and our lawyer consultation.
In short
- Check whether you are a controller or a processor: in both cases, a record is expected.
- Do not overestimate the under-250-employee exception: it falls away as soon as there is regular processing or sensitive data.
- For each processing operation, enter the purposes, legal bases, categories of data and of data subjects, recipients and retention periods.
- Document transfers outside the European Union and the associated safeguards.
- Link the record with the data protection impact assessment (DPIA) for high-risk processing.
- Keep the record up to date and be able to present it to the CNPD in the event of an inspection.
| Heading | Expected content |
|---|---|
| Identity | Name and contact details of the controller, the representative and the DPO where relevant |
| Purposes | Objective of each processing operation (payroll, recruitment, prospecting, and so on) |
| Data subjects | Categories of persons: employees, customers, prospects, suppliers |
| Data processed | Categories of data: identity, contact details, financial data, sensitive data |
| Recipients | Categories of internal and external recipients |
| Transfers outside the EU | Third countries concerned and safeguards governing the transfer |
| Retention periods | Period envisaged for each category of data |
| Security | General description of the technical and organisational measures |
What is the record of processing activities (article 30 of the GDPR)
The record of processing activities is the document that lists, in a structured way, all the operations by which an organisation processes personal data. It is provided for by article 30 of the GDPR and is the practical expression of the principle of accountability: the organisation must not only comply with the rules, but also be able to demonstrate it.
In practice, the record maps each processing operation: payroll management, recruitment, commercial prospecting, video surveillance, customer management or IT security. For each one, it states why the data are processed, on what legal basis, which persons and which categories of data are concerned, to whom the data are disclosed and how long they are kept.
The record is not a mere administrative formality: it is the tool for steering your compliance. Well kept, it makes it possible to identify risky processing, to prepare any impact assessment and to respond quickly to an inspection by the CNPD (National Commission for Data Protection) or to a request to exercise rights. A GDPR lawyer helps to structure it so that it faithfully reflects your activity.
Who must keep a record of processing activities
The record-keeping obligation applies both to the controller, that is, the organisation that determines the purposes and means of the processing, and to the processor, which processes the data on behalf of another. In Luxembourg, almost all companies, associations and public entities fall into one of these categories.
The content of the record differs according to your role. The controller documents its own processing operations and their purposes. The processor, for its part, keeps a record of the categories of processing activities carried out on behalf of its controller clients. The same company may also hold both roles, depending on the processing concerned.
Correctly determining your status is a legal step in its own right, as it determines your obligations and your liability. This analysis often overlaps with the one carried out when drafting a data processing contract, which must also comply with the GDPR.
The under-250-employee exception and its limits
Article 30 of the GDPR provides for an apparent exemption for organisations with fewer than 250 employees. Many directors wrongly conclude that they have no record to keep. The reality is very different, as this exception is subject to cumulative conditions that strip it of most of its scope.
The exemption applies only if the processing is not likely to result in a risk to the rights and freedoms of individuals, if it is occasional and if it covers neither special categories of data (such as health, opinions or biometric data) nor data relating to criminal convictions. Yet as soon as a company manages payroll, employment contracts or a customer file, it carries out regular processing: the exception falls away.
In practice, almost all organisations must therefore keep a record, at least for their recurring processing. Rather than seeking to rely on a fragile exemption, it is better to establish a record proportionate to your activity. A GDPR lawyer secures this analysis and avoids a false impression of compliance.
The mandatory content of the controller's record
For the controller, article 30 sets out a precise list of entries. The record must state the name and contact details of the controller and, where relevant, of the representative and of the data protection officer (DPO). For each processing operation, it specifies the purposes pursued, for example human resources management or invoicing.
The record then describes the categories of data subjects (employees, customers, prospects, suppliers) and the categories of data processed (identity, contact details, financial data, health data where relevant). It lists the categories of recipients, internal and external, as well as any transfers to third countries and the safeguards that govern them.
Two entries complete the whole: the retention periods envisaged for each category of data, and a general description of the technical and organisational security measures. The table below sets out all of these headings to make it easier to build your record.
The content of the processor's record
The processor does not have to document the purposes determined by its clients, but it must keep its own record of the categories of processing activities carried out on behalf of each controller. This record states its identity, that of each controller on whose behalf it acts, and where relevant that of its DPO and its representative.
For each client, the processor states the categories of processing carried out, any transfers outside the European Union and the associated safeguards, as well as a general description of the security measures implemented. This information must be consistent with the data processing agreement concluded with the controller.
This link between the record and the contract is essential: the data processing agreement governs the relationship legally, while the record documents its operational reality. A contract lawyer ensures consistency between the two documents.
How to build your record of processing activities
Building a record begins with an inventory of processing operations. This involves asking each department (human resources, sales, accounting, IT) to list the operations carried out on personal data. This initial mapping is the most demanding step, as it often reveals forgotten processing operations.
For each processing operation identified, the article 30 headings are then completed: purpose, legal basis, categories of data subjects and of data, recipients, transfers, retention periods and security measures. The choice of legal basis (consent, contract, legal obligation, legitimate interest) is a delicate legal point that deserves careful checking.
Software tools can assist in keeping the record and make updating it smoother, but they do not replace legal analysis. The characterisation of processing operations, the choice of legal bases and the assessment of risks are matters for a lawyer's advice, with digital tools only assisting the documentation. To scope the process, you can request a quote.
Updating the record and the link with the data protection impact assessment (DPIA)
The record is a living document: it must be kept up to date with every change in the organisation. Any new processing operation, any change of purpose, any new service provider or IT tool must be reflected in it. A static record quickly becomes inaccurate and loses its evidential value before the CNPD.
The record is also the starting point for the data protection impact assessment (DPIA). Where a processing operation is likely to result in a high risk to the rights and freedoms of individuals (systematic monitoring, large-scale processing of sensitive data, profiling), the GDPR requires a DPIA to be carried out before the processing is implemented.
The record makes it possible to identify the processing operations concerned and to trigger the DPIA at the right time. The impact assessment evaluates the risks and defines the measures to reduce them. These two documents complement each other: the record maps, the DPIA examines the sensitive processing operations in depth. A GDPR lawyer secures how they fit together.
CNPD inspections and the role of the lawyer
In Luxembourg, the supervisory authority is the National Commission for Data Protection (CNPD). In the event of an inspection, one of the first requests concerns the record of processing activities: it must be capable of being presented without delay and faithfully reflect the processing really carried out. A missing, incomplete or outdated record constitutes a breach of article 30.
The record is therefore both a compliance tool and an element of defence. A rigorously kept record demonstrates the organisation's good faith and its compliance efforts, which are taken into account in assessing any breach. Conversely, its absence weakens the company's entire position before the CNPD.
The role of the lawyer is to make the characterisation of processing operations, the choice of legal bases and the risk assessment reliable, and then to prepare the organisation for any inspection. Cerno Law Firm, registered with the Luxembourg Bar, supports this process through a lawyer consultation or a dedicated compliance engagement.
| Criterion | Controller | Processor |
|---|---|---|
| Purpose | Its own processing operations | Categories of activities for each client |
| Purposes | To be documented | Determined by the controller |
| Transfers outside the EU | To be documented | To be documented |
| Security measures | To be documented | To be documented |
| Contractual link | Internal policy | GDPR data processing agreement |
Depending on your profile
For Luxembourg SMEs
Even with fewer than 250 employees, an SME that manages payroll, employment contracts and a customer file carries out regular processing: the exception does not apply and a record is expected for this recurring processing.
For processor service providers
If you process data on behalf of clients (hosting provider, agency, software publisher), you must keep a record of the categories of processing activities per client, consistent with your data processing agreements.
For associations and non-profit organisations
An association processes data relating to members, donors or beneficiaries. It must list this processing, specify its legal bases and retention periods, and keep a record proportionate to its activity.
For healthcare entities
The processing of health data falls within the special categories of data: the under-250-employee exception does not apply and an impact assessment is often required in addition to the record.
Official sources
Update history
- : Conditions for the exemption from the record under article 30(5) of the GDPR clarified: occasional processing, no risk, neither sensitive data nor data relating to criminal convictions.