A supervisory authority asking to see your compliance will ask for the record of processing activities first. This pack builds outwards from that: GDPR Article 30 records at the centre, with the 94 documents that evidence them around it. 95 editable files across twelve numbered sections, downloadable the moment you check out. On this page:
- What is in the toolkit
- Why GDPR Article 30 records are the document that gets asked for first
- Who needs GDPR Article 30 records
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the GDPR Article 30 records pack
The sections follow the order a data protection programme is actually built, not the order the Regulation is written:
- 00 Toolkit Guidance and 01 GDPR Preparation Project – the implementation plan, project documents and the sequencing that stops a programme stalling at the data mapping stage
- 02 Roles, Awareness and Training – DPO appointment and role documents, awareness material and training records
- 03 Personal Data Analysis – the data inventory and the record of processing activities that Article 30 requires, for both controller and processor roles
- 04 Privacy Policy and Notices – external privacy notice, employee notice and the layered notice material
- 05 Rights of the Data Subject – the request handling procedure, identity verification, response templates and the request log
- 06 Controllers and Processors – controller-processor agreements, joint controller arrangements, processor due diligence and sub-processor control
- 07 Data Protection Impact Assessment – the DPIA threshold test, the assessment itself as a worked example, and the consultation position
- 08 International Transfers – transfer risk assessments, standard contractual clause material and the supplementary measures analysis
- 09 Personal Data Breach Management – detection, assessment against the notification thresholds, the 72 hour notification process and the breach register
- 10 Information Security Policies – the security measures Article 32 requires you to have and be able to describe
- 11 Other Data Protection Templates – retention schedules, consent records, legitimate interests assessments and the supporting registers
Why GDPR Article 30 records are the document that gets asked for first
Article 30 obliges most organisations to maintain a written record of processing activities, covering purposes, categories of data and data subjects, recipients, transfers, retention periods and security measures. It is one of the few GDPR obligations that names a document outright.
That makes it the natural starting point for any supervisory authority enquiry, and the reason a programme that skipped data mapping falls apart under scrutiny. Almost everything else – your lawful basis analysis, your retention schedule, your transfer assessments, your DPIA threshold decisions – is downstream of knowing what you actually process.
The GDPR Article 30 records here are provided for both the controller and the processor role, because organisations are routinely both and the two records require different content. The rest of the pack is structured so each entry in the record resolves to the notice, agreement, assessment or procedure that supports it.
Who needs GDPR Article 30 records
Organisations with EU or UK customers or staff who need a documented position rather than a privacy policy alone. Processors whose enterprise clients demand evidence of Article 28 and Article 32 compliance before signing. Organisations that have had a data subject complaint or a breach and discovered their paperwork does not hold up. And DPOs inheriting a programme who need to establish what exists before deciding what to fix.
How the GDPR Article 30 records maps to the framework
The pack is deliberately not a folder of policies. A policy states intent; Article 30 asks for fact. The value is in the registers, assessments and records – the processing record, the breach register, the request log, the transfer assessments, the legitimate interests assessments – because those are what a regulator tests and what a policy cannot substitute for.
Frequently asked questions
Do we have to keep Article 30 records?
Most organisations do. The narrow exemption for organisations under 250 employees falls away if processing is not occasional, is likely to result in risk to individuals, or includes special category data – which covers most employers.
Does this cover UK GDPR as well?
The substantive requirements are materially the same, so the documents work for both, with the transfer material being where the two regimes diverge most.
Is the DPIA a real worked example?
Yes – a threshold test to decide whether one is needed, and a worked assessment rather than an empty form, since the difficulty is in the analysis rather than the layout.
How many documents are included?
95 editable files across twelve sections, including Word documents, Excel registers, presentations and process diagrams.
Does this make us compliant?
No documentation set can. It gives you the records and procedures the Regulation expects; compliance is whether you actually operate them and whether your processing has a lawful basis.
Related toolkits
Privacy obligations rarely stop at one regime. See the ISO 27701 Toolkit for a certifiable privacy management system, the CCPA-CPRA Toolkit for California, the DPDP Act Toolkit for India and the ISO 27001 Toolkit for the Article 32 security measures. UK controllers need the UK GDPR toolkit as well, and the privacy risk management toolkit adds the NIST Privacy Framework view.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your GDPR Article 30 records downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet