GDPR record of processing activities: who needs one and 3 filled-in examples for small businesses

On 8 October 2024, the CNIL (the French data protection authority) announced that it had sanctioned two companies with fewer than 250 employees for having no record of processing activities (in French). Being small did not protect them: their processing was not occasional, and once that is the case, the exemption for small organisations no longer applies.

Most founders assume the « registre des traitements » (record of processing activities, often shortened to RoPA) is for large groups. For an online shop or a consultant, it fits on three or four entries. The obligation comes from the GDPR, so it is the same across the EU; what is French-specific is the enforcer (the CNIL), its simplified sanction procedure and the statutory retention periods in the examples below, which come from French law. Here are three filled-in examples, ready to adapt.

What is a GDPR record of processing activities?

The record of processing activities is the written inventory of everything your business does with personal data, with, for each activity, its purpose, the data used, who receives it and how long it is kept. It is required by Article 30 of the GDPR and must be shown to the CNIL if it asks.

A “processing activity” is a use of data organised around one goal: handling orders, sending a newsletter, paying staff. A single customer file used both to deliver orders and to market to people gives you two entries, because the legal bases and retention periods differ.

The record does three concrete jobs:

• proving your compliance during an inspection, without rebuilding everything in a panic;
• feeding your privacy policy, which repeats much of its content;
• exposing blind spots: a US tool nobody had flagged, data kept forever, a provider with no contract.

What must a record of processing activities contain?

For each processing activity, the controller’s record states the purposes, the categories of people and data, the recipients, transfers outside the European Union, time limits for erasure and a general description of security measures, plus the business’s contact details. A processor keeps a shorter record, organised by client.

The record is kept in writing, including in electronic form (Art. 30(3)), and made available to the supervisory authority on request (Art. 30(4)): nothing requires you to publish it, and the format is up to you.

Do not read “where possible” as optional. For retention, an entry with no period is the first sign that you keep everything indefinitely, which Article 5 of the GDPR prohibits under the storage limitation principle.

Do small businesses with fewer than 250 employees need a record of processing?

Yes, almost always. Article 30(5) exempts organisations with fewer than 250 employees, but the exemption falls away as soon as processing is not occasional, poses a risk to individuals or involves sensitive or criminal data: managing customers, prospects or payroll is enough to lose it.

The three exceptions are alternatives: one is enough. And the first, “not occasional”, on its own rules out most of what a business does. The CNIL says so plainly on its page on the record (in French): the record must include “non-occasional processing (for example: payroll management, management of customers/prospects and suppliers, etc.)” (our translation). It adds that the exemption “is therefore limited to very specific cases of processing” and recommends, when in doubt, putting the processing in the record.

So what stays occasional? A one-off prize draw, a trade fair where you picked up a few business cards and never followed up. Your Shopify store taking orders every week, your appointment calendar, your invoice file: no.

flowchart TD
  A["You process personal data"] --> B{"250 employees or more?"}
  B -->|Yes| R["Record mandatory"]
  B -->|No| C{"Regular processing?"}
  C -->|Yes| R
  C -->|No| D{"Sensitive or criminal data?"}
  D -->|Yes| R
  D -->|No| E{"Risk to individuals?"}
  E -->|Yes| R
  E -->|No| F["Exemption possible for this activity"]

Is the 250-employee threshold going up to 750?

Perhaps, but not yet. In May 2025 the European Commission proposed extending the exemption to organisations with fewer than 750 employees, except for high-risk processing; as of 7 October 2026, the text has not been adopted and Article 30(5) applies as currently worded.

According to the joint opinion of the EDPB and the EDPS of 8 July 2025, this “Omnibus IV” proposal would make the record mandatory, below that threshold, only for processing “likely to result in a high risk” within the meaning of Article 35 of the GDPR. According to the European Parliament’s Legislative Observatory, the parliamentary committee approved the text negotiated with the Council on 2 July 2026; the plenary vote is listed for 23 November 2026, and no publication in the Official Journal is reported there.

Do not wait. The final text may differ, and even if you end up exempt, you will still have to inform people, set retention periods and put contracts in place with your providers. The EDPB and the EDPS also describe the record as “a very useful means to support compliance with several GDPR requirements”.

Is there a free CNIL record of processing template?

Yes. The CNIL offers a simplified record template as an ODS spreadsheet (in French), free to download from its page « Le registre des activités de traitement » (the record of processing activities). It opens in LibreOffice, Excel or Google Sheets.

The file is organised in tabs: a tutorial, the list of processing activities headed by the controller’s and DPO’s details, a blank form to copy for each activity, a completed example (payroll) and the drop-down lists. One thing to watch: the list of transfer safeguards still offers “Privacy shield”, which the Court of Justice of the European Union invalidated on 16 July 2020 (in French); do not pick it. The older RTF and PDF templates, still online, are no longer updated according to the CNIL: start from the ODS file.

To fill in retention periods without making them up, rely on the CNIL’s « référentiels » (reference standards): the one on managing commercial activities (decision no. 2021-131 of 23 September 2021) for customers and prospects, and the standard on retention periods for HR data, published on 2 April 2026 and updated on 20 May 2026, for employees (both in French). The periods they recommend are not binding, but departing from them means being able to justify your choice; periods set by statute, such as those in the « Code du travail » (Labour Code) or the « Code de commerce » (Commercial Code), are binding. For security, the CNIL’s practice guide for the security of personal data sets out the basic measures.

What does a record of processing look like for an online shop?

Take a Shopify store selling solid cosmetics, two co-founders, no employees. Three processing activities cover the essentials: orders, the newsletter, audience measurement.

The CNIL sources in this table are in French.

The detail that matters: if payments go through a provider that stores card data itself, say so in the entry rather than implying that you store card numbers. And the audience measurement entry must match your cookie banner: if the tool is not exempt, nothing is placed before consent.

What does a record of processing look like for a freelance consultant or coach?

An organisational consultant trading as a « micro-entrepreneur » (France’s simplified sole-trader status) who prospects SMEs on LinkedIn and by email, invoices her assignments and books sessions through an online scheduling tool.

For a solo consultant, this record fits on one page. The real work: listing your tools, checking where each one hosts the data and that a data processing agreement covers it.

What does a record of processing look like for a small agency with 3 employees?

A communications agency set up as a « SARL » (private limited company), with a manager and three employees. On top of the commercial processing come the staff-related activities, which are more sensitive and subject to precise statutory periods.

One point specific to agencies: if you run your clients’ website, email marketing or CRM, you process their data on their behalf. That makes you a processor, and Article 30(2) requires a second record, organised by client. In December 2025 the CNIL sanctioned a processor that did not keep this record (see below).

How does the record of processing relate to the privacy policy?

The record is the internal, exhaustive version; the privacy policy is the public one. Article 13 of the GDPR requires you to tell people the purposes, legal basis, recipients, transfers and retention period: exactly the columns of your record.

The safest method is to fill in the record first, then write the policy from it. A retention period that differs from one document to the other is an inconsistency anyone spots on first reading. Our guide to the privacy policy in France details what it must contain.

What is the fine for not keeping a record of processing?

A breach of Article 30 can lead to a fine of up to €10 million or 2% of worldwide annual turnover, whichever is higher (Article 83(4) of the GDPR). For a small business, the CNIL can use its simplified procedure, where the fine is capped at €20,000.

The GDPR ceiling is the same across the EU; the simplified procedure (in French) is specific to France. Its €20,000 ceiling applies when worldwide annual turnover does not exceed €50 million; above that, it rises to €100,000 (« loi Informatique et Libertés » (French Data Protection Act), art. 22-1). Three decisions where the record is among the breaches:

All three CNIL sources in this table are in French. In the two detailed decisions, the record is not the only breach: it comes on top of others and makes the case heavier. Our guide to CNIL fines covers the amounts and procedures.

How do I keep my record of processing up to date?

Update the record whenever a processing activity appears, changes or ends: a new tool, a new provider, a new way of collecting data. An annual review catches whatever slipped through during the year.

The record sits alongside other internal documents, such as your providers’ contracts and your data breach procedure. For the full list for your business, see our guide to mandatory legal documents in France, or run the free obligations check from your SIREN (French company registration number). And to see where your website stands in two minutes, take the website compliance quiz.