New: a ready-to-use data breach response checklist.New: data breach response checklist.Download the checklist
Free templateXLSX and ODS

Record of Processing Starter Kit

Everything you need for a usable Article 30 record by the end of the day. It comes filled in with 12 example activities from a fictional SME, so you adapt instead of starting from zero.

  • Controller record with the Art. 30(1) fields, and processor record with the Art. 30(2) fields
  • Drop-down lists for legal basis, data categories and retention, instead of typing them
  • A 10-point checklist and a summary that shows what still needs review
Reviewed
23 Oct 2026
Legal basis
GDPR Art. 30
Size
30 KB (XLSX) · 38 KB (ODS)

Download the kit

Enter your email and download both versions straight away, Excel and LibreOffice.

Helps us choose the next resources.

See how we handle your data in the privacy policy.

What’s inside

Five sheets, one afternoon of work.

Sheet 1Start hereThe four steps to fill in the record and the five questions to ask each team.
Sheet 2Controller recordOne row per purpose, with 12 examples already written and empty rows for yours.
Sheet 3Processor recordOnly if you process data on behalf of clients, like an agency or an IT company.
Sheet 4ChecklistThe 10 points that tell you the record is ready, with an automatic summary.
Sheet 5ListsThe values behind the drop-down lists, which you can adjust.
Controller recordProcessor recordChecklist
IDActivityTeam / owner(b) PurposeLawful basis(c) Data subjects
1PayrollHR · [name]Pay salaries and meet tax and social security obligations for employees.Legal obligation (6(1)(c))Current and former employees
2RecruitmentHR · [name]Select candidates for open positions and handle unsolicited applications.To confirmCandidates
3Staff managementHR · [name]Manage the employment contract: leave, absences, working hours, training and performance…Contract (6(1)(b))Employees
Preview of the "Controller record" sheet. The examples describe a fictional SME.

Frequently asked questions

Do I have to give my email?

Yes. It helps us understand who uses the resources. We don’t ask for your name or company, and the newsletter only starts if you tick the box.

Can I use the kit with my clients?

You can use it in your organisation and in work for clients. You just can’t resell it as a product.

Does it replace legal advice?

No. The kit follows the GDPR and the guidance of the CNPD (Portugal’s data protection authority) and the EDPB, but each organisation has to confirm what applies to its own case.

Guide · 12 minRecord of processing activities: build yours in an afternoonThe step-by-step method that goes with this kit, with the Oficina Rocha case.Read the guide