Law Enforcement Directive·Article 24
Records of processing activities
Applies since May 6, 2018· Art. 63(1)
Member States shall provide for controllers to maintain a record of all categories of processing activities under their responsibility. That record shall contain all of the following information:
- the name and contact details of the controller and, where applicable, the joint controller and the data protection officer;
- the purposes of the processing;
- the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations;
- a description of the categories of data subject and of the categories of personal data;
- where applicable, the use of profiling;
- where applicable, the categories of transfers of personal data to a third country or an international organisation;
- an indication of the legal basis for the processing operation, including transfers, for which the personal data are intended;
- where possible, the envisaged time limits for erasure of the different categories of personal data;
- where possible, a general description of the technical and organisational security measures referred to in Article 29(1).
Member States shall provide for each processor to maintain a record of all categories of processing activities carried out on behalf of a controller, containing:
- the name and contact details of the processor or processors, of each controller on behalf of which the processor is acting and, where applicable, the data protection officer;
- the categories of processing carried out on behalf of each controller;
- where applicable, transfers of personal data to a third country or an international organisation where explicitly instructed to do so by the controller, including the identification of that third country or international organisation;
- where possible, a general description of the technical and organisational security measures referred to in Article 29(1).
The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form. The controller and the processor shall make those records available to the supervisory authority on request.