What is a processing register and how do I build one?

A list per processing activity: what data, what purpose, how long, who shares it. Mandatory under GDPR Art. 30; the under-250-staff exemption falls away as soon as processing is structural or high-risk, which is essentially always the case for SMBs handling customer data.

Try this first

1. 1Open a sheet or use the AP template. One row per processing: name, purpose, types of subjects, types of data.
2. 2Add the retention period and the legal basis (consent, contract, legal duty, legitimate interest).
3. 3List recipients per processing: HR tool, accounting, mail provider, external parties. Non-EEA countries separately.
4. 4Describe the security measures at a high level: MFA, encryption, access control, backup.
5. 5Review every six months or whenever a new tool comes in. The register need not be public but must be available on request to the AP.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.