A records of processing activities usually consists of an overview of the processing activities that take place in your organization, with for each processing the purpose, the legal basis, the categories of data and data subjects, the retention period, who receives the data and what security measures are associated with it. Where data is shared with another party, a processor agreement typically accompanies it. Which documents you specifically need in your case and how complete the records must be is for the Data Protection Authority or a lawyer to determine — this article only provides the general picture.
The detail that matters most in this subject is that the records of processing activities is not a snapshot. With a product safety file you collect certificates and test reports that, once obtained, remain valid for a time. With records of processing activities it works differently: as soon as you use a new tool, engage a new supplier or collect a new type of data, the records are updated accordingly. It is less a folder with supporting documents and more an ongoing log of what happens with personal data in your organization.
What typically appears in the records
For each processing you usually document why you collect the data, on what legal basis you do so, what data and data subjects are involved, how long you retain them and with whom you share them. Think of payroll administration for staff, a customer database that you use for marketing, or camera images at the entrance to your premises. Each of these examples is a separate entry in the records, with its own purpose and its own retention period. An HR manager who manages personnel files and an office manager who maintains visitor registration thus each complete a part of the same records, even if they rarely work from the same overview.
Processor agreements as a separate document
Whenever another party processes data on your behalf — an accounting firm, a cloud service, a marketing agency — there is typically a separate agreement that sets out what that party may and may not do. This document belongs in the register, but it does not replace it: the register describes what happens, the agreement determines who is responsible for it. Companies working with multiple suppliers find that this stack of agreements grows as quickly as the register itself, and keeping track of which agreement is still current becomes a task in itself.
Why this dossier is never complete
Because the register moves with what happens in your company, the question is not only which documents you need, but also who ensures they remain accurate whenever something changes. A new HR tool, an additional location, a supplier that switches: each time the question arises whether the register still reflects your actual operations. This is a different task than collecting documents once, and it is precisely why many companies keep this register separate from the rest of their compliance dossier, even though it overlaps in substance with what a product safety dossier or a packaging dossier already contains in terms of company data.
Where this belongs, and where overview helps
The substantive question of which processing activities you must register and how detailed that must be belongs with a specialized platform or a legal adviser; reglia itself makes no determination on this. What reglia does do is have the company data that appears in such a register — your Chamber of Commerce number, locations, contact persons — entered once and made available to the platform that maintains the register, so you do not have to retype it alongside your product safety dossier or packaging dossier. On the page with connected platforms you can see which platform specifically handles personal data, and what that platform does and does not expect from you.
If you want to know exactly what reglia does and does not do with your data, you can read that on the explanation of what reglia does and does not do with your data. Questions about how that data is secured can be found on the page about security and privacy, and frequently asked questions about sharing between platforms can be found on the frequently asked questions page.
Check which platforms are connected and which platform best suits maintaining your processing register; that overview gives you a picture in a few minutes of where you can turn for this obligation.