GDPR documentation: the records, notices, contracts and DPIAs you must be able to show

Why GDPR documentation matters: documents, records and accountability

The Regulation does not print a list headed "mandatory documents". What it does is place the burden of proof on you. Under Article 5(2) the controller must be able to demonstrate that every principle is met. Article 24 adds that the measures you take must be able to show compliance, be reviewed and be updated, with data protection policies where that is proportionate to the processing. If a regulator or a customer's auditor asks how you know, the answer has to be on paper or in a system.

Two kinds of material do this work. Documents state decisions and how things should run: a privacy notice, a retention rule, a data processing agreement; they change with the processing. Records show what happened: a consent captured with the wording shown, an access request answered on day 21, a breach judged not reportable. Records are evidence, so they are never rewritten afterwards.

The article-level obligations themselves are covered in GDPR requirements explained, article by article. This guide covers what must exist in writing.

What the GDPR requires in writing, and what is only common practice

Before anyone drafts, sort each proposed item: what a named article asks for, and what practitioners keep because it makes a decision provable. Only the first is non-negotiable.

If nobody can say which decision a document proves, it is probably shelfware.

The record of processing activities

The Article 30 record is the backbone of the set, and supervisory authorities can ask to see it. A controller's record names the organisation and its contacts, the purposes of each processing activity, the categories of people and of data, the recipients, any transfers outside the EU with their safeguards, retention periods where that is possible, and a general description of security measures. A processor keeps a shorter record listing the categories of processing it carries out for each controller. Both must be in writing, and electronic form counts, so a well-structured register in software or even a controlled spreadsheet is acceptable.

The exemption for organisations with fewer than 250 people is narrower than many assume. It falls away when the processing is not occasional, is likely to result in a risk, or includes special-category data or data on criminal convictions. The European Commission has proposed widening the exemption; until any amendment is adopted, the current threshold and conditions apply.

Build the record from a data inventory, not a blank template: interview the people who run each system and follow the data from collection to deletion. A record written from memory lists the systems management knows and misses the ones staff actually use.

Notices, processor agreements and transfer records

Privacy notices

Articles 13 and 14 set what people must be told, whether the data came from them or from elsewhere, and Article 12 sets how it is given and how people's requests are handled. Customers, job applicants and employees usually need separate notices. Version each one, so you can show which text a person saw.

Processor agreements

Every processor must work under a contract or other legal act carrying the Article 28(3) terms: acting on documented instructions, confidentiality, Article 32 security, rules on sub-processors, help with rights requests and with security, breaches and DPIAs, deletion or return at the end, and information for audits. A supplier's own data processing terms can serve if they contain all of these. Sub-processors need your prior written authorisation, specific or general, so keep the current sub-processor list with the agreement.

Transfer records

For each flow of personal data outside the EU and EEA, record the destination, the data, and the mechanism relied on: an adequacy decision, the Commission's standard contractual clauses, binding corporate rules or, rarely, a derogation. Cloud hosting, remote support and group companies are where transfers hide.

DPIAs, the breach log and the rights-request log

A DPIA is due before processing likely to result in a high risk. Article 35(7) sets its minimum content: the processing and its purposes, necessity and proportionality, the risks to people and the measures to address them. A designated DPO's advice must be sought, and if high risk remains, Article 36 requires consulting the supervisory authority first.

Article 33(5) requires every personal data breach to be documented, whether or not it was notified to the supervisory authority. A useful entry states what happened, who was affected, the risk assessment and the action taken. Entries for incidents judged unlikely to result in a risk matter most: they carry the reasoning a regulator will test.

Rights requests must be answered without undue delay and within one month, extendable by two further months with reasons. No article names a log, but without one you cannot show deadlines were met.

A minimal GDPR document set for a small organisation

A 40-person company with payroll, a CRM, a website and two cloud suppliers can usually manage with this set:

• A data inventory and the Article 30 record generated from it, with a retention period per activity.
• A lawful-basis register with legitimate-interest assessments.
• Three or four privacy notices: website and customers, job applicants, employees.
• Consent records where consent is the basis.
• Signed processor agreements with sub-processor lists.
• A transfer list naming the safeguard for each flow outside the EU and EEA.
• One data protection policy sized to the business.
• A breach procedure and breach log; a rights-request procedure and request log.
• A DPIA screening question and template.
• A note of the DPO decision, and training records.

An ISO/IEC 27001 system already holds much of the Article 32 evidence; reuse it rather than writing a parallel security policy (see GDPR vs ISO/IEC 27701, ISO/IEC 27001 and SOC 2).

What to avoid: copied packs and procedures nobody follows

The commonest failure is a downloaded bundle describing systems, suppliers and retention periods unrelated to yours; a client auditor spots it by comparing the record with the systems named in interviews. Close behind: a notice promising rights handling nobody knows how to deliver, and consent used for everything but seldom provable.

Checking that the set stays current is a job for the GDPR internal audit, and keeping it in one controlled place is what Effivity for the GDPR is designed for. If your organisation also processes data under the UK regime, GDPR vs UK GDPR sets out where the documentation can be shared.

GDPR documentation: questions buyers ask