GDPR Records of Processing (Article 30) for Irish Employers

GDPR records of processing under Article 30 are the written inventory of what personal data an organisation handles and why. Many Irish employers assume they are exempt because they have fewer than 250 staff. According to the Data Protection Commission (DPC), that assumption is often wrong, especially for HR and payroll data. This guide sets out what Article 30 says, what the DPC's guidance adds, and how an employer in Dublin or elsewhere in Ireland can approach a record in practice.

It is general information from official sources, not legal advice.

What Article 30 requires

On EUR-Lex, Article 30 of the GDPR (Regulation (EU) 2016/679) has five paragraphs. In summary:

• Controllers must maintain a record of processing activities under their responsibility.
• Processors must maintain a record of all categories of processing activities carried out on behalf of a controller.
• The records must be in writing, including in electronic form.
• Controllers and processors must make the record available to the supervisory authority on request.
• The duty does not apply to an enterprise or organisation employing fewer than 250 persons, with exceptions described below.

In Ireland the supervisory authority is the DPC. Its page on Records of Processing (Article 30) says Article 30 requires controllers to maintain a Record of Processing Activities (RoPA), that a RoPA is one way to demonstrate the accountability principle in Article 5(2), and that controllers and processors must be able to provide records to the DPC on request. That page shows no last-updated date. It links to a Guidance Note on RoPA dated April 2023 (version last updated March 2023), and that note is the main source for the detail below.

The "under 250 employees" exemption and why it rarely helps employers

The text of Article 30 says the exemption does not apply where the processing is likely to result in a risk to the rights and freedoms of data subjects, where the processing is not occasional, or where it includes special categories of data or data on criminal convictions and offences.

The DPC guidance note explains what that means in practice. If any one of those conditions applies, the RoPA duty applies to that type of processing. The note gives examples and says:

• processing likely to result in a risk, not only a high risk, is caught, with examples such as mortgage applications, AI use and location tracking;
• processing that is not occasional is caught, and the note gives HR or payroll processing for employees as an example;
• special category and criminal conviction data are caught, with examples including Garda vetting, trade union membership and biometric data.

The practical consequence, as the DPC note puts it, is that "most organisations will need to record processing activities such as HR and payroll functions". For the wider staff-training side of data protection, see our guide on the GDPR training requirements for employers.

What a controller's record must contain

The DPC guidance note reproduces the fields required of controllers by Article 30(1):

• name and contact details of the controller, any joint controller, the controller's representative and the data protection officer;
• the purposes of the processing;
• categories of data subjects and categories of personal data;
• categories of recipients, including recipients in third countries or international organisations;
• where applicable, transfers to third countries or international organisations, identifying the destination and documenting safeguards;
• where possible, the envisaged time limits for erasure of each category of data;
• where possible, a general description of the technical and organisational security measures.

For processors, the note lists the processor's details and those of each controller it acts for, the categories of processing carried out for each controller, any third-country transfers with safeguards, and, where possible, a general description of security measures.

What an HR record might look like

The DPC note uses HR as an example: a single function may have several purposes, covering employees, contractors and interns, with data such as health and safety information, sick leave and payroll details. Our reading is that an HR entry could be broken down into rows such as recruitment, payroll, absence management, and disciplinary and grievance matters. That is our suggestion, not a DPC template.

A practical approach for each row is to record:

• the purpose, in specific terms;
• whose data it is (applicants, employees, contractors);
• the data categories, for example contact details, bank details, absence records;
• who receives it, such as a payroll provider or pension administrator;
• how long you keep it, and why;
• the security measures, described specifically.

If staff make access requests, the record is also a handy map of where to look; our guide to data subject access requests for HR covers that process.

Format and quality: what the DPC says to do and avoid

The guidance note says a RoPA should be a standalone, self-explanatory document. Templates, samples, DPIAs, undefined acronyms and hyperlinks to inaccessible documents are not sufficient. Electronic records are generally more suitable. It also states that a simple spreadsheet may suffice for smaller organisations.

The note's best-practice points include:

• break the RoPA down by business function, such as HR, finance and marketing;
• carry out a data mapping exercise involving the relevant units;
• give granular detail for each data subject category, data category and processing activity, including retention periods;
• spread responsibility beyond the DPO, with named process owners and review dates;
• treat the RoPA as a living document, adding new processing and archiving obsolete activities.

The pitfalls it lists include letting the RoPA go out of date, referring to outdated mechanisms such as Privacy Shield, using vague entries such as "personal data" or "appropriate security", and keeping personal data "just in case".

When the DPC can ask for it

According to the note, the DPC may request the RoPA at any time, including during breach management, complaint handling, inquiries, investigations and future sweeps, and failure to have it ready may be treated as non-compliance. It also states that ten days should be sufficient notice for any organisation in all circumstances. The note does not set out fines for a missing record, and neither do we; we did not rely on any penalty figure from an official page.

A practical review cycle

Our suggestions, which are not legal requirements:

• Assign one named owner per business function and put a review date in the document.
• Make adding or changing a system, supplier or process trigger an update to the record.
• Check supplier contracts so that you know which suppliers are processors acting for you.
• Keep a dated copy each time you review, so you can show how the record developed.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Does a small business with fewer than 250 employees need a RoPA?

Often yes. The DPC guidance note says the exemption does not apply to risky processing, processing that is not occasional, or processing of special category or criminal conviction data, and it gives HR and payroll as an example of non-occasional processing.

Does a processor need its own record?

Yes. Article 30(2), as summarised in the DPC note, requires processors to keep a record of all categories of processing carried out for each controller.

Does the record have to be on paper?

No. Article 30 says records must be in writing, including in electronic form, and the DPC says electronic records are generally more suitable.

Can I just use a template?

The DPC note says templates and samples are not sufficient; the record must be specific to your organisation and self-explanatory.

Review the DPC's current guidance whenever you update your record.