Templates and records · ISO 27701 · Clause A.1 y A.2

ISO 27701 record of processing activities template

The centrepiece of the privacy system: which data are processed, why, about whom, who they are shared with and how long they are kept, one processing activity at a time.

In one sentence

The record of processing activities sets out, for each processing activity, the purpose, the categories of data subjects and data, the recipients, any international transfers, the erasure deadlines and the security measures, because GDPR article 30 requires it of both controller and processor and ISO/IEC 27701 includes it among the controls in its tables A.1 and A.2.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 27701 · Clause A.1 y A.2 The 2025 edition is cited: numbers 4 to 10 are clauses; A.1, A.2 and A.3 are the Annex A tables with the controls for the controller, for the processor and common to both.
Type of information: Mandatory document A document that must be kept up to date (GDPR art. 30; controls in tables A.1 and A.2)
Who fills it in: The owner of each processing activity, with the data protection officer Whoever knows the process describes it; the officer or the PIMS manager checks that it is complete
When: Before processing starts and whenever it changes A new tool, a new supplier or a new purpose all trigger a review
How long it is kept: For as long as the processing exists It is a living document: it is updated and the previous version kept, so you can show what it looked like at any point.

What the standard requires

What ISO 27701 demands and what it leaves to your judgement

The standard asks controllers and processors to keep a record of the processing they carry out, in enough detail to manage it and demonstrate it. It prescribes no template: what it requires is that the record be complete, current and known to whoever decides on each processing activity.

The GDPR spells out the minimum content: article 30(1) for the controller and 30(2) for the processor, which records the categories of processing it performs on behalf of each customer. It must be kept in writing, including in electronic form, and made available to the supervisory authority on request.

Article 30(5) exempts organisations with fewer than 250 employees unless the processing is likely to result in a risk, is not occasional or includes special categories of data. In practice almost no company with its own staff is exempt, because payroll is anything but occasional.

Read it in context: Controls for controllers and processors, in the ISO 27701 Academy

Structure

Fields the template should include

Name and contact details of the controller and, where applicable, the data protection officer
The organisation’s role: controller, joint controller or processor
Purpose of the processing and lawful basis
Categories of data subjects and personal data
Categories of recipients, including processors
International transfers and safeguards applied
Envisaged erasure deadlines
General description of the security measures
Systems or applications supporting the processing
Date of the last review and who carried it out

Example

Example: payroll processing at a fictitious company

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Processing activity	ROPA-04 · Payroll management · Northbank Engineering Ltd (fictitious)
Role	Controller
Purpose and lawful basis	Payment of salaries and social security and tax obligations · Performance of the employment contract and legal obligation
Data subjects and data	86 employees · Identification, bank, pay and family-status data for tax purposes
Recipients	External payroll bureau (processor, contract PR-2026-03), social security and tax authorities, bank
Transfers	None
Erasure	For the duration of employment and afterwards for as long as the applicable limitation periods run
Measures	Access limited to two administration staff, two-factor authentication, encrypted transfer to the payroll bureau
Review	12 March 2026 · PIMS manager

At the audit

Mistakes auditors commonly flag

The record was drawn up once and does not reflect the tools adopted since.
The lawful basis is given as “consent” for employment processing that actually rests on the contract or the law.
The processor copies a controller’s record and fails to separate the processing it carries out for each customer.
Erasure deadlines say “as required by law” without specifying any.
Processors listed in the record have no contract in force.

In Kimobox

How this record is kept in Kimobox

1Each processing activity is an entry in the record with its owner and review date.
2Adding a new tool or supplier launches a workflow that forces a review of the processing affected.
3Recipients are linked to the supplier and its processor contract.
4Version history lets you show what the record looked like on any given date.

Frequently asked questions

What people ask us before getting started

Is the record of processing activities the same as the data inventory?

Not quite. The record describes processing —what the data are used for— with the content set by article 30. The inventory goes down to where the data sit: systems, files, copies. The first is mandatory; the second is good practice that feeds the risk assessment.

Does it have to be published?

The GDPR does not require it: it has to be made available to the supervisory authority on request. Some national laws require public bodies to publish it.

How often should it be reviewed?

Whenever a processing activity changes and, in addition, through a planned periodic review, usually annual, which the certification auditor will check in their sample.

Keep your ISO 27701 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring