Record of processing activities for freelancers and SMEs: template
In a record of processing activities (verwerkingsregister) you write down which personal data you process and why. Pick the tools you use below, and they are already in your record with their data processing agreement and data location.
Do you need a record of processing activities?
With more than 250 employees, always. With fewer too, as soon as one of these situations applies:
- You process personal data more than occasionally. According to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) that is rarely the case in practice: the data of your customers or employees already counts.
- The processing poses a high risk to the people whose data it is.
- You process special categories of personal data, such as data about health, religion or political views.
How you set up the record is up to you. So a spreadsheet works too. If the AP asks for it, you must be able to account for your processing activities.
What must be in it?
The GDPR prescribes which information you include as a controller. According to the AP:
- 1Name and contact detailsOf your own business, of any joint controllers and of your data protection officer if you have one.
- 2PurposesWhat you process the data for, such as recruiting staff, delivering products or direct marketing. The AP recommends also stating the legal basis; that is not mandatory.
- 3Data subjectsWhose data you process, such as customers or employees.
- 4Personal dataWhich types of data, such as name and address details, phone numbers or IP addresses.
- 5Retention periodWhen you delete the data, if that is known.
- 6RecipientsWho you share the data with. This includes the tools that process the data for you.
- 7Outside the EEAWhether you share data with a country or international organisation outside the EEA.
- 8SecurityA general description of your technical and organisational measures.
Where do your tools fit in the record?
An accounting package, CRM or newsletter tool processes personal data for you. That tool is then a processor and belongs with the recipients in your record. With a processor you sign a data processing agreement (DPA).
If the data is stored outside the EEA, that must also be in the record. Whether a tool stores the data in the EU and offers a data processing agreement, we check on the vendor's site. What we could not find is marked as unknown: ask the vendor in that case.
Read more about the data processing agreement on our topic page.
Your record
No tools picked yet. You can also download the template empty.
0 tools in your record. Your selection stays in your browser; we store nothing.
Blank template: Excel or CSV. Data processing agreement, data in the EU and headquarters come from our check on the vendor's site, with the date. You fill in the rest yourself.
The AP's template
The AP also has its own template for SMEs, as a Word file in Dutch, for 10 sectors: education, hospitality, retail, IT, logistics, manufacturing, services, real estate, healthcare and construction. Our template follows the same mandatory parts, as a spreadsheet and with your tools in it.
Frequently asked questions
Do I need a record of processing activities as a freelancer?
Usually, yes. Under 250 employees you must have a record if you process personal data more than occasionally, if there is a high risk or if you process special categories of personal data. According to the AP, processing is rarely occasional in practice, because customer data already counts.
What must be in a record of processing activities?
Your name and contact details, the purposes, the data subjects, the types of personal data, the retention period if known, the recipients, whether data goes outside the EEA and a general description of your security.
Does my accounting package belong in the record of processing activities?
Yes, as a recipient: the package processes personal data for you. Also note whether the data goes outside the EEA, and sign a data processing agreement with the vendor.
In what form must the record of processing activities be?
That is up to you, says the AP. So a spreadsheet like our template works too, as long as the mandatory parts are in it.
Sources
- Autoriteit Persoonsgegevens: Verantwoordingsplicht (een verwerkingsregister bijhouden)
- Autoriteit Persoonsgegevens: Sjabloon verwerkingsregister mkb
- Autoriteit Persoonsgegevens: Verwerkersovereenkomst
- AVG (Verordening (EU) 2016/679), artikel 30, op EUR-Lex
Sources (in Dutch) checked on . This is an explanation, not personal advice: the page of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) takes precedence. Is something no longer correct? Let us know.
We get a fee if you take out a subscription through us. That does not change our verdict.