Do we need a record of processing activities, and where do we start?
Short answer
Almost always, yes: if an organisation has employees and clients, it needs a record of processing activities. The starting point is not the document's format, but a simple list of what your organisation does with people's data.
On this page
1.Why the exemption does not apply in practice
The GDPR does not tie the register obligation to an organisation's size, but to the nature of the processing. Smaller organisations have an exemption available, but it stops applying once the processing is not occasional, once special category data is processed, or once the processing could pose a risk to people's rights.
Payroll calculation, administering client contracts or video surveillance are not occasional processing — they are ongoing processes. So in practice the exemption ends up covering almost nothing.
Even if your case did fall under the exemption, the register is still the first document a supervisory authority asks for, and the only way to know what data you hold. Without it you cannot respond to a person's request, assess the scope of a breach, or say which supplier contracts are missing. For the exact wording of the provision and the conditions of the exemption, see Article 30(5) GDPR.
2.First step: a list of processes, not a document
Sit down with your accountant and administrator and write down what the organisation does with people's data. You almost always end up with a similar list: employee administration and payroll, candidate screening, performance of client contracts and invoicing, debt administration, video surveillance, access control, marketing communications, website enquiries, supplier contacts. For a small organisation this usually comes to eight to fifteen lines.
The list should reflect what actually happens, not what is written in old rules. If one employee sends marketing emails from their own mailbox, that is still an organisational process and it must be on the list.
3.What to fill in for each row
For each process, answer the same questions: what is the purpose, whose data is it, what categories of data, what is the legal basis, how long is it kept, who is it shared with, and does the data leave the European Economic Area. In total, Article 30(1) sets out 24 information fields, but most of them are filled in by the same answers repeated across different processes.
Leave unknowns marked as open questions rather than filling them in with a vague general phrase. An empty field shows what needs to be decided; a nice but imprecise sentence hides that decision and becomes a problem during an inspection.
4.When the register is considered finished
The register is finished once every process has a purpose, a legal basis, a retention period and a list of recipients, and you can print it out and explain every row. From that point it becomes a working tool: internal rules, privacy notices and the list of contracts are drawn from it.
The register is not a one-off document. When a system, a supplier or a process changes, the relevant row is reviewed. In practice that is a few dozen minutes each quarter if the register is actually used, and several days of work if it has been sitting in a drawer for two years.
Official legal text
We do not paraphrase the regulation's provisions here. The official Lithuanian text of the GDPR is available in one place and is more precise than any summary.
GDPR text in Lithuanian (EUR-Lex)