Who needs to document their processing activities?

Example – processing that is not occasional

An insurance company has 100 staff. Among other things, it regularly processes personal data in the context of processing claims, sales and HR. Although the company has fewer than 250 staff, it must still document these types of processing activities because they are not occasional. However, some of the company’s processing activities occur less frequently. For instance, it occasionally carries out an internal staff engagement survey. The company doesn’t do this particular processing activity very often, so it need not document it as part of its record of processing activities.

Example – processing that is likely to result in a risk to the rights and freedoms of individuals

The same company carries out several other processing activities on an infrequent basis. For instance, it occasionally does profiling on its customer database for the purposes of insurance-risk classification. Rare though this is, the company must still document it. This is because creating inferred data through profiling can be intrusive and result in risks to individuals’ rights and freedoms.​

Example – processing that involves special category data or criminal conviction and offence data                  

From time to time, the insurance company also does recruitment campaigns. For these, it collects information on applicants’ health and ethnic origin for equal opportunities monitoring. The campaigns are rare but the company must still document this processing activity because it involves processing special category data.