Records of processing for a small business

The record of processing activities is the inventory the law requires a business to keep of what personal data it holds, why, on what basis, who it shares it with, where it sends it and how long it keeps it; small businesses are told there is an exemption and find, on reading it, that it does not apply to them, and the regulator asks for the record first in any investigation because it shows whether the business knows what it is doing with data at all. The record is drafted from a mapping exercise with the business, in the form the regulator expects, and it becomes the source for the privacy notice, the retention policy and the assessments. I draft the record with the data processing agreement and the privacy notice for the business for a fixed fee of £795, delivered in five working days, with a note on the operational steps the documents assume.

Who this is for

Small and medium-sized businesses in England and Wales that have never mapped what personal data they hold, or whose record was written once for the previous owner's business and never updated.

What matters in records of processing

The record the law requires and the exemption that rarely applies

Article 30 of the UK GDPR requires every controller and every processor to maintain a record of its processing activities in writing (including electronically) and to make it available to the Information Commissioner on request, with an exemption in Article 30(5) for organisations with fewer than 250 employees unless the processing is likely to result in a risk to individuals, is not occasional, or includes special category or criminal records data; since employing staff, running a customer database and keeping a marketing list are none of them occasional, and since sickness records are special category data, almost every small business falls outside the exemption for at least some of its processing, and the Information Commissioner's guidance says so; the Data (Use and Access) Act 2025 left the obligation in place.

What the record contains and the form it takes

A controller's record must contain the business's name and contact details (and those of any representative or data protection officer), the purposes of each processing activity, the categories of data subjects and of personal data, the categories of recipients (including those abroad), the transfers to third countries and the safeguards, the retention periods where possible, and a general description of the security measures where possible, and the Information Commissioner's template adds the lawful basis, the special category condition and the source, which the business should include because the notice and the assessments draw on them; the form is a spreadsheet or a register with one row per processing activity (customer accounts, enquiries, marketing, recruitment, payroll, CCTV, website analytics, supplier management) rather than a narrative, so that it can be updated and searched.

Mapping the data a small business holds

The record is drafted from a mapping exercise that walks through the business by function (sales and marketing, operations and delivery, finance, HR, IT, premises) and asks for each: what personal data is collected, from whom, why, where it is held (the CRM, the accounts system, email, shared drives, the app, paper), who has access, who it is shared with (processors, partners, regulators), whether it leaves the United Kingdom, how long it is kept and how it is secured; the exercise usually finds data the business had forgotten and processing it had not identified, and the record captures what is found rather than what the business assumed.

Controller records, processor records and the business that is both

A processor's record under Article 30(2) is shorter (the processor's and each controller's details, the categories of processing carried out for each controller, the transfers and the security measures), and a business that acts as a processor for clients (an agency, an IT provider, a bookkeeper, a SaaS vendor) keeps both records: the controller record for its own staff, customers and marketing, and the processor record for the processing it does for clients, which should match the data processing agreements it has signed; the record is where the roles are set out, and a business that cannot say whether it is a controller or a processor for a given activity has a record that cannot be completed, which is the signal to decide.

Keeping the record current and the audit it enables

The record should be reviewed at least annually and whenever the business starts a new activity, adopts a new system or supplier, changes a purpose or stops an activity, with the owner named and the review dated, because a record that describes the business as it was when the record was written has stopped being a record; it enables the audit the regulator carries out and the one the business should carry out itself (does the privacy notice say what the record says, do the processors in the record have data processing agreements, do the transfers in the record have safeguards, do the retention periods in the record match the retention policy, has the special category processing got a condition), and the note that comes with the documents sets out that audit as a checklist.

The record as the foundation for the notice, the retention policy and the assessments

The privacy notice is written from the record (the purposes, the bases, the recipients, the transfers, the retention), the retention policy's schedule follows the record's categories, the data processing agreements cover the processors the record lists, the international transfer documents cover the transfers it identifies, and the impact assessments under Article 35 are triggered by the activities the record flags as high risk, so that a business which starts with the record ends with a consistent set of documents and a business which starts with a generated privacy notice ends with a notice that describes a business other than its own; the data processing agreement and the privacy notice drafted alongside the record are built from it, and the record is delivered in a form the business can maintain.

What it costs

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Review of a customer's DPA, £495. They sent theirs and you need to know what you are accepting. Returned marked up with the changes to ask for and an explanation. Three working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

We have fewer than 250 staff. Are we exempt from keeping a record?

Rarely. The exemption does not apply where processing is not occasional (customer databases, marketing, payroll) or involves special category data (sickness records), so almost every business must keep a record for at least some of its processing. The regulator's guidance says the same.

What does the record look like?

A register with one row per processing activity: purpose, basis, data subjects, data categories, recipients, transfers, retention, security, condition for special category data. A spreadsheet the business can update, not a narrative.

We act as a processor for our clients. Do we need two records?

Yes: a controller record for your own staff, customers and marketing, and a processor record for the processing you do for each client, matching the data processing agreements you have signed.

Related guidance and services

• Data protection agreements and privacy terms, £795, the service this page describes
• SaaS and technology contracts, £995
• Terms and conditions drafting, £995
• Data retention policy
• Data protection impact assessment: when a small business needs one

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.