Free resource
The Article 30 record at the backbone of a privacy programme and an ISO 27701 PIMS: activity, purpose, lawful basis, categories, recipients, transfers and retention - with worked example rows.
The actual structure of the file, straight from the template we use on live engagements.
Sheet: Start here
Read this tab first, then work through the checklist. Score honestly - a 'Partly' you can see is worth more than a 'Yes' you cannot evidence. This is a working tool, not a certificate: it shows where an assessor will push, before they do.
| Topic | Detail |
|---|---|
| What this is | Your Article 30 record of processing - the backbone of a GDPR programme and of an ISO 27701 PIMS. The first rows are worked examples; delete them and record your own activities. |
| How to fill it | One row per processing activity, not per system. Be specific on lawful basis (per activity, not one blanket basis), and record transfers with the safeguard (e.g. SCCs) and a real retention period. |
| The #1 mistake | A single vague lawful basis across everything, and 'retained as long as necessary' with no period. A regulator reads both as 'we have not actually worked this out'. |
| 27701 runs with or without 27001 | ISO/IEC 27701:2025 is a stand-alone management system standard. You can build a PIMS on this record with or without an ISO 27001 ISMS. |
Sheet: RoPA
Records of processing under GDPR Article 30. The first two rows are worked examples; delete and replace with your own. One row per activity - be specific on lawful basis, transfers and retention.
| Processing activity | Purpose | Lawful basis | Data categories | Data subjects | Recipients / processors | Transfers + safeguards | Retention |
|---|---|---|---|---|---|---|---|
| Customer accounts | Provide and support the service | Contract | Name, email, usage data | Customers | [hosting], [support tool] | US - SCCs | Life of account + [X] |
| Marketing newsletter | Send opted-in updates | Consent | Email, engagement | Subscribers | [email platform] | US - SCCs | Until unsubscribe |
| Employee HR records | Employ and pay staff | Legal obligation / contract | Name, bank, tax ID, performance | Employees | [payroll], [HR system] | None (EU-only) / [X] | Employment + [statutory period] |
| Support and ticketing | Provide customer support | Legitimate interest | Name, email, ticket content | Customer users | [support tool] | US - SCCs | [X] after ticket closes |
Preview only. The download is a fully editable .xlsx file.
Go deeper
See how this template fits the wider readiness work, and where we pick it up on a live engagement.
Explore the related serviceMore resources